Newbie: Access stack avriables in a kernel module

[Wolfram Gettert (News)]

Hi Josh,
thanks for the quick response.

> First, I hope you're aware that accessing variables in a .return probe
> means you get the value from the *entry* time of the function.  That
> might be interesting for $arg, but I think $res won't be helpful.
Understood, I was not aware about that.

>
>> The code of the function in the kernel is:
>>
>> static int mplex_fop_ioctl(struct inode *inode, struct file *filp,
>>                            unsigned int cmd, unsigned long arg)
>> {
>>   int res=0;
> [...]
>> The values of arg and return are Ok. But as you see in the code of the
>> function above, res is initialized with 0. But the probe prints another
>> value. Why?
>
> res=0 is the first thing the function does, but the probe is placed
> before the function has done anything at all.  So the value you're
> reading is probably whatever happened to be in that location already,
> whether it's a register or on the stack.
>
Understood.


Thanks a lot.

Wolfram

--