linux-kernel - Re: [PATCH] objtool: Fix stack overflow in validate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <psjy5tyrapwlib45iempavojmwglmurdz26q5ybzkd4f5f3xw6@bjpssopuoavt>
Date: Tue, 2 Dec 2025 08:28:43 -0800
From: Josh Poimboeuf <jpoimboe@...nel.org>
To: x86@...nel.org
Cc: linux-kernel@...r.kernel.org, Nathan Chancellor <nathan@...nel.org>, 
	Peter Zijlstra <peterz@...radead.org>, Alexandre Chartre <alexandre.chartre@...cle.com>, 
	Ingo Molnar <mingo@...nel.org>, David Laight <david.laight.linux@...il.com>
Subject: Re: [PATCH] objtool: Fix stack overflow in validate_branch()

On Tue, Dec 02, 2025 at 08:16:28AM -0800, Josh Poimboeuf wrote:
> -static int handle_insn_ops(struct instruction *insn,
> -			   struct instruction *next_insn,
> -			   struct insn_state *state)
> +static int noinline handle_insn_ops(struct instruction *insn,
> +				    struct instruction *next_insn,
> +				    struct insn_state *state)
>  {
> +	struct insn_state prev_state __maybe_unused = *state;
>  	struct stack_op *op;
> -	int ret;
> +	int ret = 0;
>  
>  	for (op = insn->stack_ops; op; op = op->next) {
>  
>  		ret = update_cfi_state(insn, next_insn, &state->cfi, op);
>  		if (ret)
> -			return ret;
> +			goto done;
>  
>  		if (!opts.uaccess || !insn->alt_group)
>  			continue;
> @@ -3303,7 +3304,8 @@ static int handle_insn_ops(struct instruction *insn,
>  				state->uaccess_stack = 1;
>  			} else if (state->uaccess_stack >> 31) {
>  				WARN_INSN(insn, "PUSHF stack exhausted");
> -				return 1;
> +				ret = 1;
> +				goto done;
>  			}
>  			state->uaccess_stack <<= 1;
>  			state->uaccess_stack  |= state->uaccess;
> @@ -3319,6 +3321,8 @@ static int handle_insn_ops(struct instruction *insn,
>  		}
>  	}
>  
> +done:
> +	TRACE_INSN_STATE(insn, &prev_state, state);
>  	return 0;
>  }

Argh, that should return 'ret'.  Ingo, can you fix that or should I post
a v2?

-- 
Josh