Skip to content

[PW_SID:1121692] [v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()#2214

Closed
linux-riscv-bot wants to merge 2 commits into
workflow__riscv__fixesfrom
pw1121692
Closed

[PW_SID:1121692] [v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()#2214
linux-riscv-bot wants to merge 2 commits into
workflow__riscv__fixesfrom
pw1121692

Conversation

@linux-riscv-bot

Copy link
Copy Markdown

PR for series 1121692 applied to workflow__riscv__fixes

Name: [v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1121692
Version: 5

Linux RISC-V bot and others added 2 commits July 1, 2026 03:48
The fp_is_valid() function uses ALIGN(sp, THREAD_SIZE) as the upper
bound for the frame pointer check. This bound is calculated relative
to the current sp and shifts upward when sp itself exceeds the valid
stack region, allowing the unwinder to read past the end of the
allocated task stack and triggering KASAN stack-out-of-bounds.

Fix this by using absolute stack boundaries determined once before
the unwind loop:

- When sp is on the task stack, use the task's pt_regs as the upper
  bound.
- When sp is on the overflow_stack (CONFIG_VMAP_STACK=y), use the
  overflow_stack's top as the boundary.
- When sp is on the IRQ stack (CONFIG_IRQ_STACKS=y), use the IRQ
  stack's top as the boundary.
- When sp is not on any known stack, warn and return.
- For remote tasks (task != current), if sp is not on the task
  stack, warn and return since we cannot reliably determine the
  correct boundary from a different CPU's stacks.

Make the DECLARE_PER_CPU(overflow_stack) unconditional in
asm/stacktrace.h so that stacktrace.c can use
IS_ENABLED(CONFIG_VMAP_STACK) instead of #ifdef, in line with the
kernel coding style which discourages the use of #ifdef in .c files
(https://docs.kernel.org/process/coding-style.html).  This is safe
because the DEFINE_PER_CPU (memory allocation) in traps.c remains
guarded by CONFIG_VMAP_STACK; the reference in stacktrace.c is only
compiled when IS_ENABLED(CONFIG_VMAP_STACK) evaluates to true.

Fixes: a2a4d4a ("riscv: stacktrace: fixed walk_stackframe()")
Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn>
Assisted-by: YuanSheng:DeepSeek-V3.2
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 143.72 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 1428.64 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1755.98 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 28.85 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 30.23 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 1.96 seconds
Result: WARNING
Output:

CHECK: Alignment should match open parenthesis
#82: FILE: arch/riscv/kernel/stacktrace.c:40:
+static inline int fp_is_valid(unsigned long fp, unsigned long sp,
+			       unsigned long high)

CHECK: Unnecessary parentheses around 'regs->epc == pc'
#143: FILE: arch/riscv/kernel/stacktrace.c:108:
+		if (regs && (regs->epc == pc) && fp_is_valid(frame->ra, sp, high)) {

total: 0 errors, 0 warnings, 2 checks, 89 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

Commit 5b98a96a290e ("riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()") has style problems, please review.

NOTE: Ignored message types: ALLOC_SIZEOF_STRUCT CAMELCASE COMMIT_LOG_LONG_LINE GIT_COMMIT_ID MACRO_ARG_REUSE NO_AUTHOR_SIGN_OFF

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.
total: 0 errors, 0 warnings, 2 checks, 89 lines checked
CHECK: Alignment should match open parenthesis
CHECK: Unnecessary parentheses around 'regs->epc == pc'


@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 88.22 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.24 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
kdoc
Desc: Detects for kdoc errors
Duration: 0.91 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
module-param
Desc: Detect module_param changes
Duration: 0.26 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.28 seconds
Result: PASS

@linux-riscv-bot

Copy link
Copy Markdown
Author

Patch 1: "[v5] riscv: stacktrace: fix stack-out-of-bounds in walk_stackframe()"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.31 seconds
Result: PASS

@linux-riscv-bot
linux-riscv-bot force-pushed the workflow__riscv__fixes branch 5 times, most recently from 2b6a725 to da477a6 Compare July 11, 2026 01:54
@linux-riscv-bot
linux-riscv-bot deleted the pw1121692 branch July 13, 2026 01:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants