Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How is a Linux kernel task's stack pointer determined for each thread?

I'm working on a tool that sometimes hijacks application execution, including working in a different stack.

I'm trying to get the kernel to always see the application stack when performing certain system calls, so that it will print the [stack] qualifier in the right place in /proc/pid/maps.

However, simply modifying the esp around the system call seems not to be enough. When I use my tool on "cat /proc/self/stat" I'm seeing kstkesp (entry 29 here) sometimes has the value I want but sometimes has a different value, corresponding to my alternate stack.

I'm trying to understand:

  1. How is the value reflected in /proc/self/stat:29 determined?
  2. Can I modify it so that it will reliably have an appropriate value?
  3. If 2 is difficult to answer, where would you recommend that I look to understand why the value is intermittently incorrect?
like image 766
nitzanms Avatar asked Jun 11 '15 15:06

nitzanms


1 Answers

Looks like it's defined e.g. in line 409 of http://lxr.free-electrons.com/source/fs/proc/array.c?v=3.16 to me.

There is lots of discussion about the related macro KSTK_ESP over the last few years for example: https://github.com/davet321/rpi-linux/commit/32effd19f64908551f8eff87e7975435edd16624

and

http://lists.openwall.net/linux-kernel/2015/01/04/140

From what I gather regarding the intermittent oddness it seems like an NMI or other interrupt hits inside the kernel sometimes and then it doesn't properly walk the stack in that case.

like image 181
Rudi Cilibrasi Avatar answered Nov 17 '22 01:11

Rudi Cilibrasi