fix(memtrack): restore uretprobe-hijacked return addresses in captured stacks

[not-matthias]

TL;DR: Nested allocator probes (operator new → malloc) copied the uretprobe trampoline into captured stacks, cutting C++ memory flamegraphs off at operator new. Memtrack now writes the real return addresses back before hashing (x86_64 only).

• Memtrack puts a uretprobe on every hooked allocator. On entry, the kernel replaces that function's return address with the [uprobes] trampoline. When it calls another hooked allocator (operator new → malloc, glibc realloc → malloc), the nested capture copies the trampoline, and offline DWARF unwinding stops there.
• capture_stack_inner now copies the stack, writes each pending return_instance's orig_ret_vaddr back into the slot the kernel hijacked (ri->stack - sp on x86_64, only if it still holds the trampoline), then hashes.
• The kernel does the same for perf and bpf_get_stackid callchains since v6.11 (torvalds/linux@4a365eb8a6d9, fixup_uretprobe_trampoline_entries), but not for raw bpf_probe_read_user copies. It matches trampoline values in an unwound callchain. Raw stack bytes also hold stale trampoline words, so this patches by slot, not by value.
• Test test_nested_allocator_stack_has_no_uretprobe_trampoline: the fixture's payload stacks must contain no trampoline word and must contain the return address into the fixture's allocate. Without the fix, 16/16 payload stacks contain the trampoline.
• CI (ubuntu-24.04, e2e C++ memory job with this memtrack): cpp_fractal_computation 575 nodes / 134 roots / 307 hex frames → 137 / 1 / 0. cpp_parallel_fractal_computation 12,576 / 1,088 / 5,974 → 159 / 2 / 3; the remaining 3 hex frames are thread-start frames, not trampolines.

Review notes

• Reads kernel-internal uprobe_task/return_instance/xol_area fields via CO-RE.
• x86_64 only. arm64 hijacks the link register, and the kernel does not track where the callee spills it, so there is no exact slot to patch; arm64 C++ stacks still stop at operator new.

Fixes COD-3758

[codspeed]

Merging this PR will not alter performance

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

✅ 31 untouched benchmarks
⏩ 6 skipped benchmarks¹

---

_{Comparing cod-3758-memtrack-c-allocation-stacks-stop-at-operator-new-uretprobe (4421efa) with main (bcad8db)}

Footnotes

1. 6 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Fixes stack unwinding for nested memory allocator hooks.

The PR appears safe to merge based on the reviewed changes.

Summary

The PR restores original x86_64 return addresses in captured allocator stacks before hashing them, and adds a C++ fixture and regression test for nested allocator calls.

• The since-review helper extraction preserves the stack capture sequence.
• No new actionable issue was identified in this PR’s changes.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Copy user stack] --> B[Restore pending uretprobe return slots]
  B --> C[Hash restored bytes]
  C --> D[Emit or deduplicate stack record]

Loading

_{Reviews (4) · Last reviewed commit: "refactor(memtrack): split stack copy and..."}

[GuillaumeLagrange]

olgtm