fixup! fixup! Fix ARM64 stack corruption in ghost_stack by skipping internal frames

Author: pablogsal

src/memray/_memray/ghost_stack/src/ghost_stack.cpp

@@ -52,7 +52,7 @@ extern "C" void ghost_ret_trampoline();
 // Logging (minimal, stderr only)
 // ============================================================================
 
-// #define DEBUG
+#define DEBUG 1
 #ifdef DEBUG
 #define LOG_DEBUG(...) do { fprintf(stderr, "[GS] " __VA_ARGS__); fflush(stderr); } while(0)
 #else
@@ -302,42 +302,57 @@ class GhostStackImpl {
 #ifdef __linux__
             unw_save_loc_t loc;
             int save_loc_ret = unw_get_save_loc(&cursor, GS_RA_REGISTER, &loc);
+            LOG_DEBUG("cap_inst[%zu]: ip=0x%lx sp(fp)=0x%lx actual_sp=0x%lx\n",
+                      frame_idx, (unsigned long)ip, (unsigned long)sp, (unsigned long)actual_sp);
+            LOG_DEBUG("cap_inst[%zu]: unw_get_save_loc ret=%d type=%d addr=0x%lx\n",
+                      frame_idx, save_loc_ret, (int)loc.type, (unsigned long)loc.u.addr);
 
             if (save_loc_ret == 0 && loc.type == UNW_SLT_MEMORY && loc.u.addr != 0) {
                 ret_loc = reinterpret_cast<uintptr_t*>(loc.u.addr);
             }
 #else
             // macOS: return address is at fp + sizeof(void*)
+            LOG_DEBUG("cap_inst[%zu]: ip=0x%lx sp(fp)=0x%lx actual_sp=0x%lx\n",
+                      frame_idx, (unsigned long)ip, (unsigned long)sp, (unsigned long)actual_sp);
             ret_loc = reinterpret_cast<uintptr_t*>(sp + sizeof(void*));
+            LOG_DEBUG("cap_inst[%zu]: ret_loc=fp+8=%p\n", frame_idx, (void*)ret_loc);
 #endif
 
             if (!ret_loc) {
+                LOG_DEBUG("cap_inst[%zu]: no ret_loc, breaking\n", frame_idx);
                 break;
             }
 
             uintptr_t ret_addr = *ret_loc;
+            LOG_DEBUG("cap_inst[%zu]: ret_addr=0x%lx (at %p)\n",
+                      frame_idx, (unsigned long)ret_addr, (void*)ret_loc);
 
             // Strip PAC (Pointer Authentication Code) if present.
             // On ARM64 with PAC, return addresses have authentication bits
             // that must be stripped before comparison or storage.
             uintptr_t stripped_ret_addr = ptrauth_strip(ret_addr);
+            LOG_DEBUG("cap_inst[%zu]: stripped_ret_addr=0x%lx trampoline=0x%lx\n",
+                      frame_idx, (unsigned long)stripped_ret_addr,
+                      (unsigned long)reinterpret_cast<uintptr_t>(ghost_ret_trampoline));
 
             // Check if already patched (cache hit)
             // Compare against stripped address since trampoline address doesn't have PAC
             if (stripped_ret_addr == reinterpret_cast<uintptr_t>(ghost_ret_trampoline)) {
                 found_existing = true;
+                LOG_DEBUG("cap_inst[%zu]: found existing trampoline\n", frame_idx);
                 break;
             }
 
             // Store the stack pointer that the trampoline will pass.
             // This allows longjmp detection by comparing against the stored value.
             //
-            // On x86_64: RET pops return address, so trampoline sees ret_loc + 8
-            // On ARM64:  RET doesn't touch SP. The trampoline receives the actual SP
-            //            at the moment of return (after the function's epilogue ran).
-            //            This is the value from UNW_REG_SP, not the FP (UNW_AARCH64_X29).
-#ifdef GS_ARCH_AARCH64
-            uintptr_t expected_sp = actual_sp;  // Actual SP at this frame
+            // The trampoline passes different SP values depending on platform:
+            // - x86_64: RET pops return address, so trampoline sees ret_loc + 8
+            // - Linux ARM64: Trampoline passes SP after saving registers, which
+            //                corresponds to actual_sp from libunwind
+            // - macOS ARM64: Trampoline passes ret_loc + 8 (similar to x86_64)
+#if defined(GS_ARCH_AARCH64) && defined(__linux__)
+            uintptr_t expected_sp = actual_sp;  // Linux ARM64: use actual SP
 #else
             uintptr_t expected_sp = reinterpret_cast<uintptr_t>(ret_loc) + sizeof(void*);
 #endif