Re: [PATCH RFC v2 02/11] stackdepot: add caller-owned stack trace fetching

[Marco Elver <elver@google.com>]

On Tue, Sep 08, 2026 at 02:13PM +0100, Caleb Kan wrote:
> From: Caleb Kan <ckan@cloudflare.com>
> 
> stack_depot_fetch() returns a pointer to contiguous storage owned by stack
> depot. That cannot work for a backend whose frames are not contiguous, so
> callers need an interface that copies the trace before they can support
> both backends.
> 
> Add stack_depot_fetch_into() to copy a complete trace into caller-owned
> storage. Leave the destination unchanged when it is too small, keep a zero
> handle as a no-op, and document that callers must keep the handle valid
> while copying it. Warn if a caller passes a NULL buffer or zero capacity
> for a valid handle instead of treating the stack as missing.
> 
> Unpoison the copied entries before returning them because
> lib/stackdepot.c is not instrumented by KMSAN. Add built-in KUnit tests for
> exact and oversized destinations, zero handles, and undersized buffers.
> Later patches add tests for stack depot internals.
> 
> Signed-off-by: Caleb Kan <ckan@cloudflare.com>
> ---
>  include/linux/stackdepot.h   | 36 ++++++++++++++++++
>  lib/Kconfig.debug            | 16 ++++++++
>  lib/stackdepot.c             | 28 ++++++++++++++
>  lib/tests/Makefile           |  1 +
>  lib/tests/stackdepot_kunit.c | 89 ++++++++++++++++++++++++++++++++++++++++++++
>  5 files changed, 170 insertions(+)
> 
> diff --git a/include/linux/stackdepot.h b/include/linux/stackdepot.h
> index 2cc21ffcdaf9..734529767c8a 100644
> --- a/include/linux/stackdepot.h
> +++ b/include/linux/stackdepot.h
> @@ -199,6 +199,42 @@ struct stack_record *__stack_depot_get_stack_record(depot_stack_handle_t handle)
>  unsigned int stack_depot_fetch(depot_stack_handle_t handle,
>  			       unsigned long **entries);
>  
> +/**
> + * stack_depot_fetch_into - Fetch a stack trace into caller-owned storage
> + *
> + * @handle:	Stack depot handle
> + * @entries:	Caller-owned buffer to copy the stack trace into
> + * @max_entries:	Number of frames that fit in @entries
> + *
> + * Copies the stored frames into caller-owned @entries. If fewer frames are
> + * stored than @max_entries, only the stored frames are written and their count
> + * is returned. If more frames are stored than @max_entries, the copy is skipped
> + * entirely and 0 is returned.
> + *
> + * Passing a NULL @entries buffer or zero @max_entries for a valid @handle is
> + * invalid. Callers must provide storage for @max_entries frames.
> + *
> + * Callers should size @entries to match the save-side stack depth cap (for
> + * example, %CONFIG_STACKDEPOT_MAX_FRAMES or the local stack_trace_save() limit)
> + * when losing diagnostics on an undersized buffer would be surprising.
> + *
> + * A non-zero invalid @handle, including a post-put handle, may WARN. Its return
> + * value and copied contents are undefined because the record may have been
> + * reused for another stack.
> + *
> + * Callers must ensure @handle remains valid for the duration of this call.
> + * Persistent handles saved without %STACK_DEPOT_FLAG_GET require no extra
> + * reference; handles saved with %STACK_DEPOT_FLAG_GET require a held reference.
> + * Callers must not call stack_depot_put() on persistent handles.
> + * Racing this helper with stack_depot_put() on the same handle is invalid.
> + *
> + * Return: Number of frames copied, 0 if @handle is 0, stack depot is disabled,
> + * or @max_entries is less than the number of stored frames.
> + */
> +unsigned int stack_depot_fetch_into(depot_stack_handle_t handle,
> +				    unsigned long *entries,
> +				    unsigned int max_entries);
> +
>  /**
>   * stack_depot_print - Print a stack trace from stack depot
>   *
> diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
> index 134b15a44625..fcd74edfd93a 100644
> --- a/lib/Kconfig.debug
> +++ b/lib/Kconfig.debug
> @@ -2785,6 +2785,22 @@ config RESOURCE_KUNIT_TEST
>  
>  	  If unsure, say N.
>  
> +config STACKDEPOT_KUNIT_TEST
> +	bool "KUnit test for stack depot" if !KUNIT_ALL_TESTS
> +	depends on KUNIT=y && STACKDEPOT
> +	depends on STACKDEPOT_MAX_FRAMES >= 3
> +	default KUNIT_ALL_TESTS
> +	help
> +	  Enable this option to test stack depot API behavior at boot.
> +	  This test is built in, so KUNIT must also be built in.
> +
> +	  KUnit tests run during boot and output the results to the debug log
> +	  in TAP format (https://testanything.org/). Only useful for kernel
> +	  developers running the KUnit test harness, and not intended for
> +	  inclusion into a production build.
> +
> +	  If unsure, say N.
> +
>  config SYSCTL_KUNIT_TEST
>  	tristate "KUnit test for sysctl" if !KUNIT_ALL_TESTS
>  	depends on KUNIT
> diff --git a/lib/stackdepot.c b/lib/stackdepot.c
> index 90c52f2e0d3f..4da7279d9f83 100644
> --- a/lib/stackdepot.c
> +++ b/lib/stackdepot.c
> @@ -785,6 +785,34 @@ unsigned int stack_depot_fetch(depot_stack_handle_t handle,
>  }
>  EXPORT_SYMBOL_GPL(stack_depot_fetch);
>  
> +unsigned int stack_depot_fetch_into(depot_stack_handle_t handle,
> +				    unsigned long *entries,
> +				    unsigned int max_entries)
> +{
> +	struct stack_record *stack;
> +	unsigned int nr_entries;
> +
> +	if (!handle)
> +		return 0;
> +	if (stack_depot_disabled)
> +		return 0;
> +	WARN_ON_ONCE(!entries || !max_entries);

If this triggers (e.g. entries == NULL with non-zero max_entries), it
falls through to memcpy(NULL, ...):

    if (WARN_ON_ONCE(!entries || !max_entries))
        return 0;