Kernel Stack Watch Proposed As New Linux Debugging Tool

Written by Michael Larabel in Linux Kernel on 19 August 2025 at 05:55 AM EDT. Add A Comment

Patches were posted on Monday for Kernel Stack Watch, a new lightweight debugging tool for detecting kernel stack corruption in real-time on Linux.

Jinchao Wang announced the creation of Kernel Stack Watch (kstackwatch) as this new debugging tool for uncovering kernel stack corruption. He summed up nicely with yesterday's patches:

"This patch series introduces Kernel Stack Watch (KSW), a lightweight debugging tool for detecting kernel stack corruption in real-time. The motivation comes from cases where corruption happens silently in one function but only manifests later as a crash in another, with no direct call trace connection. Such problems are often very difficult to debug with existing tools.

KSW works by combining hardware breakpoints with kprobes/kretprobes. It can watch a stack canary or a selected local variable, and detect the moment the corruption actually occurs. This allows developers to pinpoint the real source, rather than only observing the final crash.

Key features include:
- Lightweight design with minimal impact on bug reproducibility
- Real-time detection of stack corruption
- Simple configuration through `/proc/kstackwatch`
- Support for recursive functions with configurable nesting depth

To validate the approach, I have also prepared test modules and scripts that simulate corruption scenarios."

The hope is that these real-time warnings allow action to be taken prior to a crash occurring and more quickly uncovering stability issues with the Linux kernel.

👁 KSW

See the LKML patch series for those wanting to learn more about Kernel Stack Watch or trying out this early KSW code.