Skip to content

Conversation

@npitre
Copy link

@npitre npitre commented Sep 21, 2022

Z_THREAD_STACK_BUFFER() must not be used here. This is meant for stacks
defined with K_THREAD_STACK_ARRAY_DEFINE() whereas in this case we are
given a stack created with K_KERNEL_STACK_ARRAY_DEFINE().

If CONFIG_USERSPACE=y then K_THREAD_STACK_RESERVED gets defined with
a bigger value than K_KERNEL_STACK_RESERVED. Then Z_THREAD_STACK_BUFFER()
returns a pointer that is more advanced than expected, resulting in a
stack pointer outside its actual stack area and therefore memory
corruption ensues.

Fixes: #50465

Z_THREAD_STACK_BUFFER() must not be used here. This is meant for stacks
defined with K_THREAD_STACK_ARRAY_DEFINE() whereas in this case we are
given a stack created with K_KERNEL_STACK_ARRAY_DEFINE().

If CONFIG_USERSPACE=y then K_THREAD_STACK_RESERVED gets defined with
a bigger value than K_KERNEL_STACK_RESERVED. Then Z_THREAD_STACK_BUFFER()
returns a pointer that is more advanced than expected, resulting in a
stack pointer outside its actual stack area and therefore memory
corruption ensues.

Signed-off-by: Nicolas Pitre <npitre@baylibre.com>
@npitre npitre added this to the v3.2.0 milestone Sep 21, 2022
@zephyrbot zephyrbot added the area: RISCV RISCV Architecture (32-bit & 64-bit) label Sep 21, 2022
@stephanosio
Copy link
Member

stephanosio commented Sep 21, 2022

It seems we have the same issue on a few other archs as well:

sr.stack_top = Z_THREAD_STACK_BUFFER(stack) + sz;

z_mp_stack_top = Z_THREAD_STACK_BUFFER(stack) + sz;

arc_cpu_sp = Z_THREAD_STACK_BUFFER(stack) + sz;

cc @dcpleung @ruuddw

Tracked by #50467 and #50468

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: RISCV RISCV Architecture (32-bit & 64-bit)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Possible memory corruption on RISCV when userspace is enabled

8 participants