Skip to content

Conversation

@xiaoxiang781216
Copy link
Contributor

result by commit 6a3c2ad

Change-Id: I68ba79417d8da102da8d91c74496961aef242dd9
Signed-off-by: Xiang Xiao xiaoxiang@xiaomi.com

result by commit 6a3c2ad

Change-Id: I68ba79417d8da102da8d91c74496961aef242dd9
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
@acassis acassis changed the base branch from master to pr32 January 3, 2020 13:35
@acassis acassis merged commit dadf191 into apache:pr32 Jan 3, 2020
acassis pushed a commit that referenced this pull request Jan 3, 2020
Author: Alan Carvalho de Assis <acassis@gmail.com>

    Run all .h and .c files modified in last PR through nxstyle.

Author: Xiang Xiao <xiaoxiang@xiaomi.com>

    Fix stm32l4_otgfshost.c: error: 'ret' undeclared (#32)

    result by commit 6a3c2ad

    Change-Id: I68ba79417d8da102da8d91c74496961aef242dd9
    Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
@xiaoxiang781216 xiaoxiang781216 deleted the fix-stm32l4_otgfshost branch January 6, 2020 08:32
GUIDINGLI added a commit to GUIDINGLI/incubator-nuttx that referenced this pull request Oct 11, 2024
set CONFIG_PRIORITY_INHERITANCE=y
set CONFIG_SEM_PREALLOCHOLDERS=0 or CONFIG_SEM_PREALLOCHOLDERS=8

    apache#24 0x4dcab71 in __assert assert/lib_assert.c:37
    apache#25 0x4d6b0e9 in nxsem_destroyholder semaphore/sem_holder.c:602
    apache#26 0x4d80cf7 in nxsem_destroy semaphore/sem_destroy.c:80
    apache#27 0x4d80db9 in sem_destroy semaphore/sem_destroy.c:120
    apache#28 0x4dcb077 in nxmutex_destroy misc/lib_mutex.c:122
    apache#29 0x4dc6611 in pipecommon_freedev pipes/pipe_common.c:117
    apache#30 0x4dc7fdc in pipecommon_close pipes/pipe_common.c:397
    apache#31 0x4ed4f6d in file_close vfs/fs_close.c:78
    apache#32 0x6a91133 in local_free local/local_conn.c:184
    apache#33 0x6a92a9c in local_release local/local_release.c:129
    apache#34 0x6a91d1a in local_subref local/local_conn.c:271
    apache#35 0x6a75767 in local_close local/local_sockif.c:797
    apache#36 0x4e978f6 in psock_close socket/net_close.c:102
    apache#37 0x4eed1b9 in sock_file_close socket/socket.c:115
    apache#38 0x4ed4f6d in file_close vfs/fs_close.c:78
    apache#39 0x4ed1459 in nx_close_from_tcb inode/fs_files.c:754
    apache#40 0x4ed1501 in nx_close inode/fs_files.c:781
    apache#41 0x4ed154a in close inode/fs_files.c:819
    apache#42 0x6bcb9ce in property_get kvdb/client.c:307
    apache#43 0x6bcd465 in property_get_int32 kvdb/common.c:270
    apache#44 0x5106c9a in tz_offset_restore app/miwear_bluetooth.c:745
    apache#45 0x510893f in miwear_bluetooth_main app/miwear_bluetooth.c:1033
    apache#46 0x4dcf5c8 in nxtask_startup sched/task_startup.c:70
    apache#47 0x4d70873 in nxtask_start task/task_start.c:134
    apache#48 0x4e04a07 in pre_start sim/sim_initialstate.c:52

Signed-off-by: ligd <liguiding1@xiaomi.com>
xiaoxiang781216 pushed a commit that referenced this pull request Oct 11, 2024
set CONFIG_PRIORITY_INHERITANCE=y
set CONFIG_SEM_PREALLOCHOLDERS=0 or CONFIG_SEM_PREALLOCHOLDERS=8

    #24 0x4dcab71 in __assert assert/lib_assert.c:37
    #25 0x4d6b0e9 in nxsem_destroyholder semaphore/sem_holder.c:602
    #26 0x4d80cf7 in nxsem_destroy semaphore/sem_destroy.c:80
    #27 0x4d80db9 in sem_destroy semaphore/sem_destroy.c:120
    #28 0x4dcb077 in nxmutex_destroy misc/lib_mutex.c:122
    #29 0x4dc6611 in pipecommon_freedev pipes/pipe_common.c:117
    #30 0x4dc7fdc in pipecommon_close pipes/pipe_common.c:397
    #31 0x4ed4f6d in file_close vfs/fs_close.c:78
    #32 0x6a91133 in local_free local/local_conn.c:184
    #33 0x6a92a9c in local_release local/local_release.c:129
    #34 0x6a91d1a in local_subref local/local_conn.c:271
    #35 0x6a75767 in local_close local/local_sockif.c:797
    #36 0x4e978f6 in psock_close socket/net_close.c:102
    #37 0x4eed1b9 in sock_file_close socket/socket.c:115
    #38 0x4ed4f6d in file_close vfs/fs_close.c:78
    #39 0x4ed1459 in nx_close_from_tcb inode/fs_files.c:754
    #40 0x4ed1501 in nx_close inode/fs_files.c:781
    #41 0x4ed154a in close inode/fs_files.c:819
    #42 0x6bcb9ce in property_get kvdb/client.c:307
    #43 0x6bcd465 in property_get_int32 kvdb/common.c:270
    #44 0x5106c9a in tz_offset_restore app/miwear_bluetooth.c:745
    #45 0x510893f in miwear_bluetooth_main app/miwear_bluetooth.c:1033
    #46 0x4dcf5c8 in nxtask_startup sched/task_startup.c:70
    #47 0x4d70873 in nxtask_start task/task_start.c:134
    #48 0x4e04a07 in pre_start sim/sim_initialstate.c:52

Signed-off-by: ligd <liguiding1@xiaomi.com>
xiaoxiang781216 pushed a commit that referenced this pull request Dec 18, 2024
When enable CONFIG_STACK_CANARIES, in general, the stack check in the __gcov_fork function is:
" return fork();
18: e59f3020 ldr r3, [pc, #32] @ 40 <__gcov_fork+0x40>
1c: e5932000 ldr r2, [r3]
20: e59d3004 ldr r3, [sp, #4]
24: e0332002 eors r2, r3, r2
28: e3a03000 mov r3, #0
2c: 1a000002 bne 3c <__gcov_fork+0x3c>"
r3 is obtained by taking the value of sp offset. But after opening thumb, the second comparison value in
"8c6: 4a06 ldr r2, [pc, #24] @ (8e0 <__gcov_fork+0x30>)
8c8: 6811 ldr r1, [r2, #0]
8ca: 687a ldr r2, [r7, #4]
8cc: 4051 eors r1, r2"
is obtained through r7. Since r7 stores the stack address at this time, which stores the address of the parent process, the stack out of bounds will occur in the child process

Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
jerpelea pushed a commit to jerpelea/nuttx that referenced this pull request Dec 19, 2024
When enable CONFIG_STACK_CANARIES, in general, the stack check in the __gcov_fork function is:
" return fork();
18: e59f3020 ldr r3, [pc, apache#32] @ 40 <__gcov_fork+0x40>
1c: e5932000 ldr r2, [r3]
20: e59d3004 ldr r3, [sp, apache#4]
24: e0332002 eors r2, r3, r2
28: e3a03000 mov r3, #0
2c: 1a000002 bne 3c <__gcov_fork+0x3c>"
r3 is obtained by taking the value of sp offset. But after opening thumb, the second comparison value in
"8c6: 4a06 ldr r2, [pc, apache#24] @ (8e0 <__gcov_fork+0x30>)
8c8: 6811 ldr r1, [r2, #0]
8ca: 687a ldr r2, [r7, apache#4]
8cc: 4051 eors r1, r2"
is obtained through r7. Since r7 stores the stack address at this time, which stores the address of the parent process, the stack out of bounds will occur in the child process

Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
xiaoxiang781216 pushed a commit that referenced this pull request Dec 19, 2024
When enable CONFIG_STACK_CANARIES, in general, the stack check in the __gcov_fork function is:
" return fork();
18: e59f3020 ldr r3, [pc, #32] @ 40 <__gcov_fork+0x40>
1c: e5932000 ldr r2, [r3]
20: e59d3004 ldr r3, [sp, #4]
24: e0332002 eors r2, r3, r2
28: e3a03000 mov r3, #0
2c: 1a000002 bne 3c <__gcov_fork+0x3c>"
r3 is obtained by taking the value of sp offset. But after opening thumb, the second comparison value in
"8c6: 4a06 ldr r2, [pc, #24] @ (8e0 <__gcov_fork+0x30>)
8c8: 6811 ldr r1, [r2, #0]
8ca: 687a ldr r2, [r7, #4]
8cc: 4051 eors r1, r2"
is obtained through r7. Since r7 stores the stack address at this time, which stores the address of the parent process, the stack out of bounds will occur in the child process

Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
linguini1 pushed a commit to CarletonURocketry/nuttx that referenced this pull request Jan 15, 2025
When enable CONFIG_STACK_CANARIES, in general, the stack check in the __gcov_fork function is:
" return fork();
18: e59f3020 ldr r3, [pc, apache#32] @ 40 <__gcov_fork+0x40>
1c: e5932000 ldr r2, [r3]
20: e59d3004 ldr r3, [sp, #4]
24: e0332002 eors r2, r3, r2
28: e3a03000 mov r3, #0
2c: 1a000002 bne 3c <__gcov_fork+0x3c>"
r3 is obtained by taking the value of sp offset. But after opening thumb, the second comparison value in
"8c6: 4a06 ldr r2, [pc, apache#24] @ (8e0 <__gcov_fork+0x30>)
8c8: 6811 ldr r1, [r2, #0]
8ca: 687a ldr r2, [r7, #4]
8cc: 4051 eors r1, r2"
is obtained through r7. Since r7 stores the stack address at this time, which stores the address of the parent process, the stack out of bounds will occur in the child process

Signed-off-by: wangmingrong1 <wangmingrong1@xiaomi.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants