1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
|
// SPDX-License-Identifier: GPL-2.0
/*
* Copyright (C) 2008 Steven Rostedt <srostedt@redhat.com>
*
*/
#include <linux/sched/task_stack.h>
#include <linux/stacktrace.h>
#include <linux/security.h>
#include <linux/kallsyms.h>
#include <linux/seq_file.h>
#include <linux/spinlock.h>
#include <linux/uaccess.h>
#include <linux/ftrace.h>
#include <linux/module.h>
#include <linux/sysctl.h>
#include <linux/init.h>
#include <asm/setup.h>
#include "trace.h"
#define STACK_TRACE_ENTRIES 500
static unsigned long stack_dump_trace[STACK_TRACE_ENTRIES];
static unsigned stack_trace_index[STACK_TRACE_ENTRIES];
static unsigned int stack_trace_nr_entries;
static unsigned long stack_trace_max_size;
static arch_spinlock_t stack_trace_max_lock =
(arch_spinlock_t)__ARCH_SPIN_LOCK_UNLOCKED;
DEFINE_PER_CPU(int, disable_stack_tracer);
static DEFINE_MUTEX(stack_sysctl_mutex);
int stack_tracer_enabled;
static void print_max_stack(void)
{
long i;
int size;
pr_emerg(" Depth Size Location (%d entries)\n"
" ----- ---- --------\n",
stack_trace_nr_entries);
for (i = 0; i < stack_trace_nr_entries; i++) {
if (i + 1 == stack_trace_nr_entries)
size = stack_trace_index[i];
else
size = stack_trace_index[i] - stack_trace_index[i+1];
pr_emerg("%3ld) %8d %5d %pS\n", i, stack_trace_index[i],
size, (void *)stack_dump_trace[i]);
}
}
/*
* The stack tracer looks for a maximum stack at each call from a function. It
* registers a callback from ftrace, and in that callback it examines the stack
* size. It determines the stack size from the variable passed in, which is the
* address of a local variable in the stack_trace_call() callback function.
* The stack size is calculated by the address of the local variable to the top
* of the current stack. If that size is smaller than the currently saved max
* stack size, nothing more is done.
*
* If the size of the stack is greater than the maximum recorded size, then the
* following algorithm takes place.
*
* For architectures (like x86) that store the function's return address before
* saving the function's local variables, the stack will look something like
* this:
*
* [ top of stack ]
* 0: sys call entry frame
* 10: return addr to entry code
* 11: start of sys_foo frame
* 20: return addr to sys_foo
* 21: start of kernel_func_bar frame
* 30: return addr to kernel_func_bar
* 31: [ do trace stack here ]
*
* The save_stack_trace() is called returning all the functions it finds in the
* current stack. Which would be (from the bottom of the stack to the top):
*
* return addr to kernel_func_bar
* return addr to sys_foo
* return addr to entry code
*
* Now to figure out how much each of these functions' local variable size is,
* a search of the stack is made to find these values. When a match is made, it
* is added to the stack_dump_trace[] array. The offset into the stack is saved
* in the stack_trace_index[] array. The above example would show:
*
* stack_dump_trace[] | stack_trace_index[]
* ------------------ + -------------------
* return addr to kernel_func_bar | 30
* return addr to sys_foo | 20
* return addr to entry | 10
*
* The print_max_stack() function above, uses these values to print the size of
* each function's portion of the stack.
*
* for (i = 0; i < nr_entries; i++) {
* size = i == nr_entries - 1 ? stack_trace_index[i] :
* stack_trace_index[i] - stack_trace_index[i+1]
* print "%d %d %d %s\n", i, stack_trace_index[i], size, stack_dump_trace[i]);
* }
*
* The above shows
*
* depth size location
* ----- ---- --------
* 0 30 10 kernel_func_bar
* 1 20 10 sys_foo
* 2 10 10 entry code
*
* Now for architectures that might save the return address after the functions
* local variables (saving the link register before calling nested functions),
* this will cause the stack to look a little different:
*
* [ top of stack ]
* 0: sys call entry frame
* 10: start of sys_foo_frame
* 19: return addr to entry code << lr saved before calling kernel_func_bar
* 20: start of kernel_func_bar frame
* 29: return addr to sys_foo_frame << lr saved before calling next function
* 30: [ do trace stack here ]
*
* Although the functions returned by save_stack_trace() may be the same, the
* placement in the stack will be different. Using the same algorithm as above
* would yield:
*
* stack_dump_trace[] | stack_trace_index[]
* ------------------ + -------------------
* return addr to kernel_func_bar | 30
* return addr to sys_foo | 29
* return addr to entry | 19
*
* Where the mapping is off by one:
*
* kernel_func_bar stack frame size is 29 - 19 not 30 - 29!
*
* To fix this, if the architecture sets ARCH_RET_ADDR_AFTER_LOCAL_VARS the
* values in stack_trace_index[] are shifted by one to and the number of
* stack trace entries is decremented by one.
*
* stack_dump_trace[] | stack_trace_index[]
* ------------------ + -------------------
* return addr to kernel_func_bar | 29
* return addr to sys_foo | 19
*
* Although the entry function is not displayed, the first function (sys_foo)
* will still include the stack size of it.
*/
static void check_stack(unsigned long ip, unsigned long *stack)
{
unsigned long this_size, flags; unsigned long *p, *top, *start;
static int tracer_frame;
int frame_size = READ_ONCE(tracer_frame);
int i, x;
this_size = ((unsigned long)stack) & (THREAD_SIZE-1);
this_size = THREAD_SIZE - this_size;
/* Remove the frame of the tracer */
this_size -= frame_size;
if (this_size <= stack_trace_max_size)
return;
/* we do not handle interrupt stacks yet */
if (!object_is_on_stack(stack))
return;
/* Can't do this from NMI context (can cause deadlocks) */
if (in_nmi())
return;
local_irq_save(flags);
arch_spin_lock(&stack_trace_max_lock);
/* In case another CPU set the tracer_frame on us */
if (unlikely(!frame_size))
this_size -= tracer_frame;
/* a race could have already updated it */
if (this_size <= stack_trace_max_size)
goto out;
stack_trace_max_size = this_size;
stack_trace_nr_entries = stack_trace_save(stack_dump_trace,
ARRAY_SIZE(stack_dump_trace) - 1,
0);
/* Skip over the overhead of the stack tracer itself */
for (i = 0; i < stack_trace_nr_entries; i++) {
if (stack_dump_trace[i] == ip)
break;
}
/*
* Some archs may not have the passed in ip in the dump.
* If that happens, we need to show everything.
*/
if (i == stack_trace_nr_entries)
i = 0;
/*
* Now find where in the stack these are.
*/
x = 0;
start = stack;
top = (unsigned long *)
(((unsigned long)start & ~(THREAD_SIZE-1)) + THREAD_SIZE);
/*
* Loop through all the entries. One of the entries may
* for some reason be missed on the stack, so we may
* have to account for them. If they are all there, this
* loop will only happen once. This code only takes place
* on a new max, so it is far from a fast path.
*/
while (i < stack_trace_nr_entries) {
int found = 0;
stack_trace_index[x] = this_size;
p = start;
for (; p < top && i < stack_trace_nr_entries; p++) {
/*
* The READ_ONCE_NOCHECK is used to let KASAN know that
* this is not a stack-out-of-bounds error.
*/
if ((READ_ONCE_NOCHECK(*p)) == stack_dump_trace[i]) {
stack_dump_trace[x] = stack_dump_trace[i++];
this_size = stack_trace_index[x++] =
(top - p) * sizeof(unsigned long);
found = 1;
/* Start the search from here */
start = p + 1;
/*
* We do not want to show the overhead
* of the stack tracer stack in the
* max stack. If we haven't figured
* out what that is, then figure it out
* now.
*/
if (unlikely(!tracer_frame)) {
tracer_frame = (p - stack) *
sizeof(unsigned long);
stack_trace_max_size -= tracer_frame;
}
}
}
if (!found)
i++;
}
#ifdef ARCH_FTRACE_SHIFT_STACK_TRACER
/*
* Some archs will store the link register before calling
* nested functions. This means the saved return address
* comes after the local storage, and we need to shift
* for that.
*/
if (x > 1) {
memmove(&stack_trace_index[0], &stack_trace_index[1],
sizeof(stack_trace_index[0]) * (x - 1));
x--;
}
#endif
stack_trace_nr_entries = x;
if (task_stack_end_corrupted(current)) {
print_max_stack();
BUG();
}
out:
arch_spin_unlock(&stack_trace_max_lock);
local_irq_restore(flags);
}
/* Some archs may not define MCOUNT_INSN_SIZE */
#ifndef MCOUNT_INSN_SIZE
# define MCOUNT_INSN_SIZE 0
#endif
static void
stack_trace_call(unsigned long ip, unsigned long parent_ip,
struct ftrace_ops *op, struct pt_regs *pt_regs)
{
unsigned long stack;
preempt_disable_notrace();
/* no atomic needed, we only modify this variable by this cpu */
__this_cpu_inc(disable_stack_tracer);
if (__this_cpu_read(disable_stack_tracer) != 1)
goto out;
/* If rcu is not watching, then save stack trace can fail */
if (!rcu_is_watching())
goto out;
ip += MCOUNT_INSN_SIZE;
check_stack(ip, &stack);
out:
__this_cpu_dec(disable_stack_tracer);
/* prevent recursion in schedule */
preempt_enable_notrace();
}
static struct ftrace_ops trace_ops __read_mostly =
{
.func = stack_trace_call,
.flags = FTRACE_OPS_FL_RECURSION_SAFE,
};
static ssize_t
stack_max_size_read(struct file *filp, char __user *ubuf,
size_t count, loff_t *ppos
|