linux-kernel - Re: [PATCH] objtool: Fix stack overflow in validate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aS8Wp6yYvDy0vBHD@gmail.com>
Date: Tue, 2 Dec 2025 17:41:11 +0100
From: Ingo Molnar <mingo@...nel.org>
To: Josh Poimboeuf <jpoimboe@...nel.org>
Cc: x86@...nel.org, linux-kernel@...r.kernel.org,
	Nathan Chancellor <nathan@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Alexandre Chartre <alexandre.chartre@...cle.com>,
	David Laight <david.laight.linux@...il.com>
Subject: Re: [PATCH] objtool: Fix stack overflow in validate_branch()

* Josh Poimboeuf <jpoimboe@...nel.org> wrote:

> On Tue, Dec 02, 2025 at 08:16:28AM -0800, Josh Poimboeuf wrote:
> > -static int handle_insn_ops(struct instruction *insn,
> > -			   struct instruction *next_insn,
> > -			   struct insn_state *state)
> > +static int noinline handle_insn_ops(struct instruction *insn,
> > +				    struct instruction *next_insn,
> > +				    struct insn_state *state)
> >  {
> > +	struct insn_state prev_state __maybe_unused = *state;
> >  	struct stack_op *op;
> > -	int ret;
> > +	int ret = 0;
> >  
> >  	for (op = insn->stack_ops; op; op = op->next) {
> >  
> >  		ret = update_cfi_state(insn, next_insn, &state->cfi, op);
> >  		if (ret)
> > -			return ret;
> > +			goto done;
> >  
> >  		if (!opts.uaccess || !insn->alt_group)
> >  			continue;
> > @@ -3303,7 +3304,8 @@ static int handle_insn_ops(struct instruction *insn,
> >  				state->uaccess_stack = 1;
> >  			} else if (state->uaccess_stack >> 31) {
> >  				WARN_INSN(insn, "PUSHF stack exhausted");
> > -				return 1;
> > +				ret = 1;
> > +				goto done;
> >  			}
> >  			state->uaccess_stack <<= 1;
> >  			state->uaccess_stack  |= state->uaccess;
> > @@ -3319,6 +3321,8 @@ static int handle_insn_ops(struct instruction *insn,
> >  		}
> >  	}
> >  
> > +done:
> > +	TRACE_INSN_STATE(insn, &prev_state, state);
> >  	return 0;
> >  }
> 
> Argh, that should return 'ret'.  Ingo, can you fix that or should I post
> a v2?

No need, I've fixed it up.

Thanks,

	Ingo