[PATCH v8 09/27] mm/ksw: ignore false positives from exit trampolines
From: Jinchao Wang <hidden>
Date: 2025-11-10 16:37:23
Also in:
linux-doc, linux-mm, linux-perf-users, lkml, llvm, workflows
Subsystem:
memory management, the rest · Maintainers:
Andrew Morton, Linus Torvalds
Because trampolines run after the watched function returns but before the exit_handler is called, and in the original stack frame, so the trampoline code may overwrite the watched stack address. These false positives should be ignored. is_ftrace_trampoline() does not cover all trampolines, so add a local check to handle the remaining cases. Signed-off-by: Jinchao Wang <redacted> --- mm/kstackwatch/watch.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+)
diff --git a/mm/kstackwatch/watch.c b/mm/kstackwatch/watch.c
index 3817a172dc25..f922b4164be5 100644
--- a/mm/kstackwatch/watch.c
+++ b/mm/kstackwatch/watch.c@@ -2,6 +2,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <linux/cpuhotplug.h> +#include <linux/ftrace.h> #include <linux/hw_breakpoint.h> #include <linux/irqflags.h> #include <linux/kstackwatch.h>
@@ -14,10 +15,46 @@ static DEFINE_MUTEX(all_wp_mutex); static ulong holder; +#define TRAMPOLINE_NAME "return_to_handler" +#define TRAMPOLINE_DEPTH 16 + +/* Resolved once, then reused */ +static unsigned long tramp_start, tramp_end; + +static void ksw_watch_resolve_trampoline(void) +{ + unsigned long sz, off; + + if (likely(tramp_start && tramp_end)) + return; + + tramp_start = kallsyms_lookup_name(TRAMPOLINE_NAME); + if (tramp_start && kallsyms_lookup_size_offset(tramp_start, &sz, &off)) + tramp_end = tramp_start + sz; +} + +static bool ksw_watch_in_trampoline(unsigned long ip) +{ + if (tramp_start && tramp_end && ip >= tramp_start && ip < tramp_end) + return true; + return false; +} static void ksw_watch_handler(struct perf_event *bp, struct perf_sample_data *data, struct pt_regs *regs) { + unsigned long entries[TRAMPOLINE_DEPTH]; + int i, nr = 0; + + nr = stack_trace_save_regs(regs, entries, TRAMPOLINE_DEPTH, 0); + for (i = 0; i < nr; i++) { + //ignore trampoline + if (is_ftrace_trampoline(entries[i])) + return; + if (ksw_watch_in_trampoline(entries[i])) + return; + } + pr_err("========== KStackWatch: Caught stack corruption =======\n"); pr_err("config %s\n", ksw_get_config()->user_input); dump_stack();
@@ -164,6 +201,7 @@ int ksw_watch_init(void) { int ret; + ksw_watch_resolve_trampoline(); ret = ksw_watch_alloc(); if (ret <= 0) return -EBUSY;
--
2.43.0