From: rask@formelder.dk (Rask Ingemann Lambertsen)
To: linux-arm-kernel@lists.infradead.org
Subject: Stack overflow in merge_fdt_bootargs()?
Date: Thu, 6 Jul 2017 21:14:49 +0200 [thread overview]
Message-ID: <20170706191448.vbb72qev7o4frzld@localhost> (raw)
In arch/arm/boot/compressed/atags_to_fdt.c, we have
static void merge_fdt_bootargs(void *fdt, const char *fdt_cmdline)
{
char cmdline[COMMAND_LINE_SIZE];
const char *fdt_bootargs;
char *ptr = cmdline;
int len = 0;
which means a stack frame of at least 1030 bytes. This is called very early
on from head.S via atags_to_fdt(). How much stack space is available?
I ask because all kernels after (but not including) v4.0.0 have hung with
no output on my Trimslice, which runs an old boot loader without device tree
support. The kernels for it have CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_EXTEND
enabled to pick up the command line passed in by the boot loader using the
old ATAG mechanism. Between v4.0.0 and v4.1-rc1, head.S was changed by commit
c2607f74aad96d18316a6e709b40e0ffe9def148 so that potentially much less room
is left between the FDT and the stack[1]. The size of the DTB is 21152 bytes,
and prevously, the buffer set aside for manipulating the DTB was 64 kB while
now, it comes out to 32 kB in my case.
I've managed to boot a newer kernel by hacking merge_fdt_bootargs() so the
stack frame stays below 1024 bytes, so a stack overflow seems to be a
possible explanation.
[1] The way head.S is written suggests to me that on entry to head.S, the stack
follows immediately after the appended DTB.
--
Rask Ingemann Lambertsen
reply other threads:[~2017-07-06 19:14 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170706191448.vbb72qev7o4frzld@localhost \
--to=rask@formelder.dk \
--cc=linux-arm-kernel@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox