On Sun, Jul 20, 2025 at 01:21:18PM +0200, Jiri Olsa wrote: > +static void destroy_uprobe_trampoline(struct uprobe_trampoline *tramp) > +{ > + /* > + * We do not unmap and release uprobe trampoline page itself, > + * because there's no easy way to make sure none of the threads > + * is still inside the trampoline. > + */ > + hlist_del(&tramp->node); > + kfree(tramp); > +} I am somewhat confused; isn't this called from __mmput()->uprobe_clear_state()->arch_uprobe_clear_state ? At that time we don't have threads anymore and mm is about to be destroyed anyway.