bpf: Fix kprobe_multi return probe backtrace
authorJiri Olsa <jolsa@kernel.org>
Mon, 21 Mar 2022 07:01:13 +0000 (08:01 +0100)
committerDaniel Borkmann <daniel@iogearbox.net>
Mon, 21 Mar 2022 13:54:15 +0000 (14:54 +0100)
commitf70986902c86f88612ed45a96aa7cf4caa65f7c1
tree07d3fa348cd149225c1a5e6078b7994508324686
parentf705ec764b34323412f14b9bd95412e9bcb8770b
bpf: Fix kprobe_multi return probe backtrace

Andrii reported that backtraces from kprobe_multi program attached
as return probes are not complete and showing just initial entry [1].

It's caused by changing registers to have original function ip address
as instruction pointer even for return probe, which will screw backtrace
from return probe.

This change keeps registers intact and store original entry ip and
link address on the stack in bpf_kprobe_multi_run_ctx struct, where
bpf_get_func_ip and bpf_get_attach_cookie helpers for kprobe_multi
programs can find it.

[1] https://lore.kernel.org/bpf/CAEf4BzZDDqK24rSKwXNp7XL3ErGD4bZa1M6c_c4EvDSt3jrZcg@mail.gmail.com/T/#m8d1301c0ea0892ddf9dc6fba57a57b8cf11b8c51

Fixes: ca74823c6e16 ("bpf: Add cookie support to programs attached with kprobe multi link")
Reported-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20220321070113.1449167-3-jolsa@kernel.org
kernel/trace/bpf_trace.c