Skip to content

[Kernel][Initialization] MSP and PSP Stack Conflict in z_interrupt_stacks Causes Memory Corruption #88929

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
FixJA opened this issue Apr 23, 2025 · 1 comment
Assignees
Labels
area: Kernel bug The issue is a bug, or the PR is fixing a bug

Comments

@FixJA
Copy link

FixJA commented Apr 23, 2025

Describe the bug
During early Zephyr initialization, the MSP (Main Stack Pointer) is set to the top of z_interrupt_stacks. However, the PSP (Process Stack Pointer) used by z_cstart already consumes part of z_interrupt_stacks. When an interrupt is triggered during z_sys_init_run_level(INIT_LEVEL_PRE_KERNEL_2), the MSP stack overwrites the PSP stack content, corrupting local variables in z_sys_init_run_level. This leads to memory out-of-bounds access and a chip exception.

here is my debug infomation

Image
bufferIndex initial value is 1
Image
An interrupt triggers the use of an MSP stack pointer, and the MSP pointer points to something that is already in use by the PSP pointer, causing the PSP stack to be corrupted
Image
bufferIndex value is charged
Image

Image

Environment (please complete the following information):

  • OS: linux
  • Toolchain Zephyr SDK 0.17
  • Zephyr OS build v4.1.0-2729-g785d0bbfb3fc
  • board: mimxrt1020_evk

Additional context
prj.conf

# Copyright (c) 2021 Nordic Semiconductor ASA
# SPDX-License-Identifier: Apache-2.0
#
# This file contains selected Kconfig options for the application.

# zephyr printf
CONFIG_SERIAL=y
CONFIG_CONSOLE=y
CONFIG_UART_CONSOLE=y
CONFIG_PRINTK=y
CONFIG_INIT_STACKS=y
CONFIG_SHELL=y
CONFIG_CONSOLE_SUBSYS=y
CONFIG_SHELL_BACKEND_SERIAL=y
CONFIG_REQUIRES_FULL_LIBC=y
CONFIG_POSIX_API=y

CONFIG_GPIO=y
CONFIG_BLINK=y

#network
CONFIG_NETWORKING=y
CONFIG_NET_IPV4=y
CONFIG_NET_ARP=y
CONFIG_NET_TCP=y
CONFIG_NET_UDP=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_DHCPV4=y
CONFIG_NET_DHCPV4_OPTION_CALLBACKS=y
CONFIG_NET_CONTEXT_RCVTIMEO=y
CONFIG_NET_CONTEXT_SNDTIMEO=y
CONFIG_DNS_RESOLVER=y
CONFIG_NET_TCP_MAX_RECV_WINDOW_SIZE=5120

CONFIG_NET_PKT_TX_COUNT=6
CONFIG_NET_BUF_RX_COUNT=64

CONFIG_NET_MGMT=y
CONFIG_NET_MGMT_EVENT=y
CONFIG_NET_CONNECTION_MANAGER=y
CONFIG_NET_CONNECTION_MANAGER_MONITOR_STACK_SIZE=2048
CONFIG_SLIP_STATISTICS=n

# shell
CONFIG_NET_SHELL=y
CONFIG_SHELL_PROMPT_UART="rt1020:~$ "
CONFIG_SHELL_BACKEND_SERIAL_TX_RING_BUFFER_SIZE=128
CONFIG_SHELL_BACKEND_SERIAL_RX_RING_BUFFER_SIZE=256

CONFIG_MAIN_STACK_SIZE=4096
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096
CONFIG_NET_TCP_WORKQ_STACK_SIZE=4096
CONFIG_NET_RX_STACK_SIZE=4096
CONFIG_NET_SOCKETS_SERVICE_STACK_SIZE=2048
CONFIG_NET_MGMT_EVENT_STACK_SIZE=2048
CONFIG_ISR_STACK_SIZE=4096

debug.conf

# compiler
CONFIG_NO_OPTIMIZATIONS=y

# logging
CONFIG_LOG=y
CONFIG_NET_LOG=y
CONFIG_APP_LOG_LEVEL_DBG=y
CONFIG_GPIO_LOG_LEVEL_DBG=y
CONFIG_ETHERNET_LOG_LEVEL_DBG=y
#debug
CONFIG_THREAD_MONITOR=y

CONFIG_STACK_SENTINEL=y
CONFIG_ASSERT=y

CONFIG_TRACING=y
CONFIG_PERCEPIO_TRACERECORDER=y
CONFIG_PERCEPIO_TRC_START_MODE_START_FROM_HOST=y
CONFIG_PERCEPIO_TRC_CFG_STREAM_PORT_RTT=y
CONFIG_PERCEPIO_TRC_CFG_CTRL_TASK_STACK_SIZE=4096
@FixJA FixJA added the bug The issue is a bug, or the PR is fixing a bug label Apr 23, 2025
Copy link

Hi @FixJA! We appreciate you submitting your first issue for our open-source project. 🌟

Even though I'm a bot, I can assure you that the whole community is genuinely grateful for your time and effort. 🤖💙

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: Kernel bug The issue is a bug, or the PR is fixing a bug
Projects
None yet
Development

No branches or pull requests

4 participants