Skip to content

Commit acdcf94

Browse files
committed
fixup! Fix ARM64 stack corruption in ghost_stack by skipping internal frames
Signed-off-by: Pablo Galindo <[email protected]>
1 parent 8a872ae commit acdcf94

File tree

1 file changed

+6
-10
lines changed

1 file changed

+6
-10
lines changed

src/memray/_memray/ghost_stack/src/ghost_stack.cpp

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -305,11 +305,6 @@ class GhostStackImpl {
305305

306306
if (save_loc_ret == 0 && loc.type == UNW_SLT_MEMORY && loc.u.addr != 0) {
307307
ret_loc = reinterpret_cast<uintptr_t*>(loc.u.addr);
308-
// Sanity check: ret_loc should be somewhere near FP (which is our sp variable)
309-
uintptr_t addr = loc.u.addr;
310-
if (addr < sp - 0x10000 || addr > sp + 0x10000) {
311-
ret_loc = nullptr; // Don't use this suspicious address
312-
}
313308
}
314309
#else
315310
// macOS: return address is at fp + sizeof(void*)
@@ -337,11 +332,12 @@ class GhostStackImpl {
337332
// Store the stack pointer that the trampoline will pass.
338333
// This allows longjmp detection by comparing against the stored value.
339334
//
340-
// On x86_64: RET pops return address, so trampoline sees ret_loc + 8
341-
// On ARM64: RET doesn't touch SP. The trampoline receives the actual SP
342-
// at the moment of return (after the function's epilogue ran).
343-
// This is the value from UNW_REG_SP, not the FP (UNW_AARCH64_X29).
344-
#ifdef GS_ARCH_AARCH64
335+
// On x86_64: RET pops return address, so trampoline sees ret_loc + 8
336+
// On ARM64: RET doesn't touch SP. The trampoline receives the actual SP
337+
// at the moment of return (after the function's epilogue ran).
338+
// This is the value from UNW_REG_SP, not the FP (UNW_AARCH64_X29).
339+
// macOS ARM64: Trampoline passes ret_loc + 8
340+
#if defined(GS_ARCH_AARCH64) && defined(__linux__)
345341
uintptr_t expected_sp = actual_sp; // Actual SP at this frame
346342
#else
347343
uintptr_t expected_sp = reinterpret_cast<uintptr_t>(ret_loc) + sizeof(void*);

0 commit comments

Comments
 (0)