10

I'm working on a tool that sometimes hijacks application execution, including working in a different stack.

I'm trying to get the kernel to always see the application stack when performing certain system calls, so that it will print the [stack] qualifier in the right place in /proc/pid/maps.

However, simply modifying the esp around the system call seems not to be enough. When I use my tool on "cat /proc/self/stat" I'm seeing kstkesp (entry 29 here) sometimes has the value I want but sometimes has a different value, corresponding to my alternate stack.

I'm trying to understand:

  1. How is the value reflected in /proc/self/stat:29 determined?
  2. Can I modify it so that it will reliably have an appropriate value?
  3. If 2 is difficult to answer, where would you recommend that I look to understand why the value is intermittently incorrect?

1 Answer 1

1
+50

Looks like it's defined e.g. in line 409 of http://lxr.free-electrons.com/source/fs/proc/array.c?v=3.16 to me.

There is lots of discussion about the related macro KSTK_ESP over the last few years for example: https://github.com/davet321/rpi-linux/commit/32effd19f64908551f8eff87e7975435edd16624

and

http://lists.openwall.net/linux-kernel/2015/01/04/140

From what I gather regarding the intermittent oddness it seems like an NMI or other interrupt hits inside the kernel sometimes and then it doesn't properly walk the stack in that case.

3
  • Rudi, what I meant is where the KSTK_ESP macro points to, that is, where is the value that we put into entry 29 of /proc/pid/stat is set, not how it is accessed to set entry 29. I'm going to give you the bounty because my question wasn't clear enough. If you can edit your answer to include that information, I would be grateful.
    – nitzanms
    Commented Jul 13, 2015 at 7:39
  • 1
    I'm afraid it would take me weeks of study to give you a more solid answer. I think it is somewhat arch specific since it involves the task block. This answer was just an hour or two and I was happy to do it because I have occasionally made a small contribution to the kernel. Sorry I can't tell you more. Commented Jul 14, 2015 at 17:09
  • That's cool. What you gave me is appreciated. Certainly better than letting all the reputation go to waste. Would it make a difference if I limited my question to x86(_64) only?
    – nitzanms
    Commented Jul 15, 2015 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.