linux-kernel - Re: [PATCH] objtool: Fix stack overflow in validate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <zfwk7bzznjhnkqmfvfn3tan7vdwzybghf5inwci5kbqlhuixwp@2cktlvdv4gjg>
Date: Tue, 2 Dec 2025 08:49:30 -0800
From: Josh Poimboeuf <jpoimboe@...nel.org>
To: Ingo Molnar <mingo@...nel.org>
Cc: x86@...nel.org, linux-kernel@...r.kernel.org, 
	Nathan Chancellor <nathan@...nel.org>, Peter Zijlstra <peterz@...radead.org>, 
	Alexandre Chartre <alexandre.chartre@...cle.com>, David Laight <david.laight.linux@...il.com>
Subject: Re: [PATCH] objtool: Fix stack overflow in validate_branch()

On Tue, Dec 02, 2025 at 05:20:22PM +0100, Ingo Molnar wrote:
> 
> * Josh Poimboeuf <jpoimboe@...nel.org> wrote:
> 
> > On an allmodconfig kernel compiled with Clang, objtool is segfaulting in
> > drivers/scsi/qla2xxx/qla2xxx.o due to a stack overflow in
> > validate_branch().
> > 
> > Due in part to KASAN being enabled, the qla2xxx code has a large number
> > of conditional jumps, causing objtool to go quite deep in its recursion.
> > 
> > By far the biggest offender of stack usage is the recently added
> > 'prev_state' stack variable in validate_insn(), coming in at 328 bytes.
> 
> That's weird - how can a user-space tool run into stack 
> limits, are they set particularly conservatively?

On my Fedora system, "ulimit -s" is 8MB.  You'd think that would be
enough :-)

In this case, objtool had over 20,000 stack frames caused by recursively
following over 7,000(!) conditional jumps in a single function.

> In any case, applied to tip:objtool/urgent, thanks!

Looks good now, thanks for fixing that up!

-- 
Josh