ftrace_graph_ret_addr(9)

💅 ftrace_graph_ret_addr(9) — or, how to un-glow-up a return address

okay bestie, welcome to the Kernel API Manual ✨ — yes, that manual, the one your kernel-dev mutuals keep quoting. today's episode: ftrace_graph_ret_addr, which returns the original value of the return address 🎀. no cap, that's the whole NAME section, and it ate.

---

✨ SYNOPSIS ✨

unsigned long ftrace_graph_ret_addr (struct task_struct *task , int *idx
, unsigned long ret , unsigned long *retp );

that's the whole signature, copy it exactly, do not come for me about the comma spacing, that's how it is in the source 💀

---

🌸 ARGUMENTS 🌸

• task — the task the unwinder is being executed on 🧚 like, which poor little process are we walking the stack for
• idx — an initialized pointer to the next stack index to use 📍 it's your lil bookmark, treat it right
• ret — the current return address (likely pointing to return_handler) 👀 "likely" is doing a lot of work there, but slay
• retp — the address on the stack of the current return location 🫶 like the home address, but for a return address

---

💖 DESCRIPTION 💖

okay so here's the tea ☕ — this function gets called by stack unwinding code, and its whole job is converting a found stack return address (ret) back to its original value 🔥. why? because the function graph tracer might have modified it to be 'return_to_handler' 😭 so the address you found is giving fake identity energy and needs a reality check.

if the address hasn't been modified? iconic. the unchanged value of ret is returned, no drama, no notes 💅

now, idx is the main character here 👑 — it holds the last index used to know where to start from. it should be initialized to zero for the first iteration, because zero means "start at the top of the shadow stack" ⭐. and if the location is found, this pointer gets assigned that location, so that if you call again it'll just continue where it left off 🎯 lowkey efficient, highkey the way that it should be.

and retp? retp is a pointer to the return address on the stack 🌈 simple, honest, doing its job.

ngl, if you're passing in an uninitialized idx on the first iteration, that's not a vibe — zero, bestie, zero 🫠

---

👑 SEE ALSO 👑

your reading list, fr fr, all of it, go off:

• Kernel file ./kernel/trace/fgraph.c
• fgraph_reserve_data(9)
• fgraph_retrieve_data(9)
• fgraph_get_task_var(9)
• fgraph_retrieve_parent_data(9)
• ftrace_graph_stop(9)
• ftrace_graph_get_ret_stack(9)
• ftrace_graph_top_ret_addr(9)

---

🎀 sign-off 🎀

this whole little masterpiece lives in ./kernel/trace 💜 and it's dated October 2026 ⭐ — yes, the future, she's ahead of her time. mwah, go read the source, ily, bye 🦋💖