linux-kernel - [BUG] Failed to obtain stack trace via bpf_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250919071902.554223-1-yangfeng59949@163.com>
Date: Fri, 19 Sep 2025 15:19:02 +0800
From: Feng Yang <yangfeng59949@....com>
To: ast@...nel.org,
	daniel@...earbox.net,
	john.fastabend@...il.com,
	andrii@...nel.org,
	martin.lau@...ux.dev,
	eddyz87@...il.com,
	song@...nel.org,
	yonghong.song@...ux.dev,
	kpsingh@...nel.org,
	sdf@...ichev.me,
	haoluo@...gle.com,
	jolsa@...nel.org
Cc: bpf@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	linux-trace-kernel@...r.kernel.org,
	mhiramat@...nel.org
Subject: [BUG] Failed to obtain stack trace via bpf_get_stackid on ARM64 architecture 

When I use bpf_program__attach_kprobe_multi_opts to hook a BPF program that contains the bpf_get_stackid function on the arm64 architecture,
I find that the stack trace cannot be obtained. The trace->nr in __bpf_get_stackid is 0, and the function returns -EFAULT.

For example:
diff --git a/tools/testing/selftests/bpf/progs/kprobe_multi.c b/tools/testing/selftests/bpf/progs/kprobe_multi.c
index 9e1ca8e34913..844fa88cdc4c 100644
--- a/tools/testing/selftests/bpf/progs/kprobe_multi.c
+++ b/tools/testing/selftests/bpf/progs/kprobe_multi.c
@@ -36,6 +36,15 @@ __u64 kretprobe_test6_result = 0;
 __u64 kretprobe_test7_result = 0;
 __u64 kretprobe_test8_result = 0;
 
+typedef __u64 stack_trace_t[2];
+
+struct {
+       __uint(type, BPF_MAP_TYPE_STACK_TRACE);
+       __uint(max_entries, 1024);
+       __type(key, __u32);
+       __type(value, stack_trace_t);
+} stacks SEC(".maps");
+
 static void kprobe_multi_check(void *ctx, bool is_return)
 {
        if (bpf_get_current_pid_tgid() >> 32 != pid)
@@ -100,7 +109,9 @@ int test_kretprobe(struct pt_regs *ctx)
 SEC("kprobe.multi")
 int test_kprobe_manual(struct pt_regs *ctx)
 {
+       int id = bpf_get_stackid(ctx, &stacks, 0);
        kprobe_multi_check(ctx, false);
+       bpf_printk("stackid: %d\n", id);
        return 0;
 }

./test_progs -t kprobe_multi_test/attach_api_pattern
#155/4   kprobe_multi_test/attach_api_pattern:OK
#155     kprobe_multi_test:OK
#156     kprobe_multi_testmod_test:OK
Summary: 2/1 PASSED, 0 SKIPPED, 0 FAILED

cat /sys/kernel/debug/tracing/trace
test_progs-68315   [004] ...1. 13377.097527: bpf_trace_printk: stackid: -14
......

Test Version:
6ff4a0fa3e1 ("bpf, arm64: Call bpf_jit_binary_pack_finalize() in bpf_jit_free()")
Linux localhost.localdomain 6.17.0-rc5+ #2 SMP PREEMPT_DYNAMIC Fri Sep 19 10:29:07 CST 2025 aarch64 aarch64 aarch64 GNU/Linux
clang version 17.0.6 ( 17.0.6-30.p03.ky11)
gcc (GCC) 12.3.1 (kylin 12.3.1-62.p02.ky11)
GNU Make 4.4.1