Skip to content

Fix Use of expired stack-address#4593

Open
odaysec wants to merge 1 commit intofacebook:devfrom
odaysec:patch-1
Open

Fix Use of expired stack-address#4593
odaysec wants to merge 1 commit intofacebook:devfrom
odaysec:patch-1

Conversation

@odaysec
Copy link

@odaysec odaysec commented Feb 21, 2026

This rule finds uses of pointers that likely point to local variables in expired stack frames. A pointer to a local variable is only valid until the function returns, after which it becomes a dangling pointer.

fix any pointer stored in g_stack remains valid for all uses in fill_stack and check_stack. Since g_stack is global and used after set_stack returns, it must not point to a local (stack) array; instead it should point to memory that outlives set_stack, such as static or heap-allocated storage.

The minimal way to fix this without changing the intended functionality (measuring stack usage) is:

  • Change g_stack from a plain char * to a small struct that holds:
    • A pointer to the buffer (char *buf).
    • A size_t size indicating the size of that buffer.
  • In set_stack, stop storing the address of the local stack array, and instead just update g_stack.size to sizeof(stack); do not let any pointer to stack escape.
  • In fill_stack, allocate a temporary local buffer char buf[8192];, fill it with 0x33, and update g_stack.buf (and g_stack.size) to point to this local buffer just for the duration of fill_stack. Immediately after filling, call use to make sure the compiler actually touches the buffer, then reset g_stack.buf to NULL before returning so that no dangling pointer remains.
  • In check_stack, instead of reading from g_stack as if it still held a valid pointer into the set_stack frame, treat g_stack.size as “how much stack was used” (reported from set_stack) and compare it against the limit; do not dereference g_stack.buf at all.

This preserves the observable behavior relevant to the test (checking that the measured “stack size” does not exceed a threshold) while preventing any use of a pointer to expired stack memory. All changes are limited to contrib/linux-kernel/test/test.c around the global g_stack and the three functions set_stack, fill_stack, and check_stack

References:
https://en.wikipedia.org/wiki/Dangling_pointer

@meta-cla meta-cla bot added the CLA Signed label Feb 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant