linux-kernel - Re: [BUG] Failed to obtain stack trace via bpf_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aNQRWlNIno3ThMkv@krava>
Date: Wed, 24 Sep 2025 17:42:18 +0200
From: Jiri Olsa <olsajiri@...il.com>
To: Feng Yang <yangfeng59949@....com>
Cc: mhiramat@...nel.org, alexei.starovoitov@...il.com, andrii@...nel.org,
	ast@...nel.org, bpf@...r.kernel.org, daniel@...earbox.net,
	eddyz87@...il.com, haoluo@...gle.com, john.fastabend@...il.com,
	kpsingh@...nel.org, linux-kernel@...r.kernel.org,
	linux-trace-kernel@...r.kernel.org, martin.lau@...ux.dev,
	sdf@...ichev.me, song@...nel.org, yonghong.song@...ux.dev
Subject: Re: [BUG] Failed to obtain stack trace via bpf_get_stackid on ARM64
 architecture

On Wed, Sep 24, 2025 at 02:25:36PM +0800, Feng Yang wrote:

SNIP

> > Hmm, can you also dump the regs and insert pr_info() to find
> > which function fails?
> > 
> > Thanks,
> > 
> 
> After testing, it was found that the stack could not be obtained because user_mode(regs) returned 1. 
> Referring to the arch_ftrace_fill_perf_regs function in your email 
> (https://lore.kernel.org/all/173518997908.391279.15910334347345106424.stgit@devnote2/), 
> I made the following modification: by setting the value of pstate, the stack can now be obtained successfully.
> 
> diff --git a/arch/arm64/include/asm/ftrace.h b/arch/arm64/include/asm/ftrace.h
> index 058a99aa44bd..f2814175e958 100644
> --- a/arch/arm64/include/asm/ftrace.h
> +++ b/arch/arm64/include/asm/ftrace.h
> @@ -159,11 +159,13 @@ ftrace_partial_regs(const struct ftrace_regs *fregs, struct pt_regs *regs)
>  {
>         struct __arch_ftrace_regs *afregs = arch_ftrace_regs(fregs);
>  
>         memcpy(regs->regs, afregs->regs, sizeof(afregs->regs));
>         regs->sp = afregs->sp;
>         regs->pc = afregs->pc;
>         regs->regs[29] = afregs->fp;
>         regs->regs[30] = afregs->lr;
> +       regs->pstate = PSR_MODE_EL1h;
>         return regs;
>  }
> However, I'm not sure if there will be any other impacts...

nice, the test works for me with this change.. could you please send
formal patch? I can polish and send out the test [1]

thanks,
jirka


[1] https://github.com/kernel-patches/bpf/pull/9845/commits/11b31cd465a83b8719cb06331c8e81794cca40fa