Random Linux Kernel functions have 16 byte stack alignment at the start of the function. This stack alignment happens before the
push %ebp mov %esp, %ebp sequence and breaks the kernel function graph tracer which needs to manipulate the return address. When the alignment happens then still 4(%ebp) contains the return address, but this is only a copy of the real stack entry which is used by the ret instruction. So the tracer modifies the copy and not the real return address stack entry. There are two problems: 1) why is gcc doing 16 byte stack aligment at all 2) why is the stack alignment happening _before_ the "push %ebp, mov %esp %ebp" sequence. -- Summary: 16 byte stack alignment on random Linux kernel functions Product: gcc Version: 4.4.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: c AssignedTo: unassigned at gcc dot gnu dot org ReportedBy: tglx at linutronix dot de GCC build triplet: i586-redhat-linux GCC host triplet: i586-redhat-linux GCC target triplet: i586-redhat-linux http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42109