linux-kernel - Re: [PATCH] objtool: Fix stack overflow in validate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <mozrkhzfjcixrndgn7eyw47xbccvvqnwhbvbqmqeh56wrxfa64@akivpivwt5ai>
Date: Tue, 2 Dec 2025 09:11:47 -0800
From: Josh Poimboeuf <jpoimboe@...nel.org>
To: Ingo Molnar <mingo@...nel.org>
Cc: x86@...nel.org, linux-kernel@...r.kernel.org, 
	Nathan Chancellor <nathan@...nel.org>, Peter Zijlstra <peterz@...radead.org>, 
	Alexandre Chartre <alexandre.chartre@...cle.com>, David Laight <david.laight.linux@...il.com>
Subject: Re: [PATCH] objtool: Fix stack overflow in validate_branch()

On Tue, Dec 02, 2025 at 06:03:49PM +0100, Ingo Molnar wrote:
> 
> * Josh Poimboeuf <jpoimboe@...nel.org> wrote:
> 
> > On Tue, Dec 02, 2025 at 05:20:22PM +0100, Ingo Molnar wrote:
> > > 
> > > * Josh Poimboeuf <jpoimboe@...nel.org> wrote:
> > > 
> > > > On an allmodconfig kernel compiled with Clang, objtool is segfaulting in
> > > > drivers/scsi/qla2xxx/qla2xxx.o due to a stack overflow in
> > > > validate_branch().
> > > > 
> > > > Due in part to KASAN being enabled, the qla2xxx code has a large number
> > > > of conditional jumps, causing objtool to go quite deep in its recursion.
> > > > 
> > > > By far the biggest offender of stack usage is the recently added
> > > > 'prev_state' stack variable in validate_insn(), coming in at 328 bytes.
> > > 
> > > That's weird - how can a user-space tool run into stack 
> > > limits, are they set particularly conservatively?
> > 
> > On my Fedora system, "ulimit -s" is 8MB.  You'd think that would be
> > enough :-)
> > 
> > In this case, objtool had over 20,000 stack frames caused by recursively
> > following over 7,000(!) conditional jumps in a single function.
> 
> Ouch ...
> 
> ... which means that very likely we'll run into this problem again. :-/
> 
> Time to add stack overflow self-detection?
> 
> I've attached a simple proof-of-concept that uses 
> sigaltstacks based SIGSEGV handler to catch a stack 
> overflow:
> 
>   starship:/s/stack-overflow> ./overflow 
>   # Starting stack recursion:
> 
>   # WARNING: SIGSEGV received: Possible stack overflow detected!
> 
>   starship:/s/stack-overflow> 
> 
> Could we add something like this to objtool, with 
> perhaps a look at the interrupted stack pointer from 
> SIGSEGV_handler(), to make sure the SIGSEGV was due to 
> a stack overflow?

Yes, I think that would be wise.  I've been thinking objtool could use a
SIGSEGV handler anyway, as it crashes more often than one would hope,
with a cryptic non-helpful error message for the user.

I'll work on it.

-- 
Josh