Skip to content

Commit d95ebe4

Browse files
committed
Fix stack extension bug causing HardFault
This patch fixes a bug in the stack extension logic that could cause a HardFault on certain configurations when the stack is reallocated to a new address. ## Background When the mruby VM's stack runs out, stack_extend_alloc() calls mrb_realloc to grow it. If reallocation moves the block to a new address, envadjust() adjusts all ci->stack pointers to point into the new allocation. ## The bug The bug happened under the configuration below: - MRB_INT64 on MRB_32BIT (`sizeof(mrb_value) == 16` because MRB_NO_BOXING is now mandatory) - Allocator with 8-byte alignment (eg. PICORB_ALLOC_ALIGN=8 in PicoRuby for Raspi Pico) The delta was computed via mrb_value* pointer subtraction: ```c ptrdiff_t delta = newbase - oldbase; // units of sizeof(mrb_value) ``` If : - Old address: 0x2004c508 - New address: 0x2004c510 (8-byte difference) The pointer subtraction truncated: 8 / 16 = 0. envadjust() was misleaded as `delta == 0` and returned early without adjusting any ci->stack pointers. The stbase was updated to the new address, but all stack pointers still pointed 8 bytes before it. Every register access was shifted, reading garbage, ultimately causing a HardFault. ## The fix Byte-level char* calculation instead of mrb_value* calculation: ```c ptrdiff_t off = (char*)newbase - (char*)oldbase; // ... ci->stack = (mrb_value*)((char*)ci->stack + off); ``` This ensures the adjustment is exact regardless of sizeof(mrb_value) and allocator alignment.
1 parent b7e3743 commit d95ebe4

File tree

1 file changed

+16
-6
lines changed

1 file changed

+16
-6
lines changed

src/vm.c

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -134,19 +134,29 @@ static inline void
134134
envadjust(mrb_state *mrb, mrb_value *oldbase, mrb_value *newbase)
135135
{
136136
mrb_callinfo *ci = mrb->c->cibase;
137-
ptrdiff_t delta = newbase - oldbase;
138-
139-
if (delta == 0) return;
137+
/*
138+
* Byte-level calculation to avoid truncation when allocator alignment is
139+
* smaller than sizeof(mrb_value).
140+
* eg: MRB_NO_BOXING + MRB_INT64 with MRB_32BIT => sizeof(mrb_value)=16
141+
* And when memory allocator's alignment is 8 bytes
142+
* Pointer subtraction on mrb_value* would truncate (8/16 -> 0).
143+
* So, we use char* for pointer calculation to get the correct offset in bytes,
144+
* then apply that offset to mrb_value* pointers.
145+
*/
146+
ptrdiff_t off = (char *)newbase - (char *)oldbase;
147+
148+
if (off == 0) return;
140149
while (ci <= mrb->c->ci) {
141150
struct REnv *e = mrb_vm_ci_env(ci);
142151

152+
mrb_value *new_stack = (mrb_value *)((char *)ci->stack + off);
153+
143154
if (e) {
144155
mrb_assert(e->cxt == mrb->c && MRB_ENV_ONSTACK_P(e));
145156
mrb_assert(e->stack == ci->stack);
146-
147-
e->stack += delta;
157+
e->stack = new_stack;
148158
}
149-
ci->stack += delta;
159+
ci->stack = new_stack;
150160
ci++;
151161
}
152162
}

0 commit comments

Comments
 (0)