search

espressif / ESP8266_RTOS_SDK

Latest ESP8266 SDK based on FreeRTOS, esp-idf style.
http://bbs.espressif.com
Apache License 2.0
3.34k stars 1.57k forks source link

mdns example triggers stack smashing protection in Strong or Overall modes. (GIT8266O-671) #1094

Open pheki opened 3 years ago

pheki commented 3 years ago

Environment

Problem Description

Running the mdns example with Overall stack smashing protection compiler option results in crash.

Expected Behavior

The program runs fine.

Actual Behavior

The program crashes with the following output:

I (42) boot: ESP-IDF v3.4-16-g911e2d7a 2nd stage bootloader
I (42) boot: compile time 17:55:29
I (43) qio_mode: Enabling default flash chip QIO
I (51) boot: SPI Speed      : 40MHz
I (57) boot: SPI Mode       : QIO
I (63) boot: SPI Flash Size : 2MB
I (69) boot: Partition Table:
I (75) boot: ## Label            Usage          Type ST Offset   Length
I (86) boot:  0 nvs              WiFi data        01 02 00009000 00006000
I (98) boot:  1 phy_init         RF data          01 01 0000f000 00001000
I (109) boot:  2 factory          factory app      00 00 00010000 000f0000
I (121) boot: End of partition table
I (127) esp_image: segment 0: paddr=0x00010010 vaddr=0x40210010 size=0x6fb74 (457588) map
0x40210010: _stext at ??:?

I (296) esp_image: segment 1: paddr=0x0007fb8c vaddr=0x4027fb84 size=0x0f93c ( 63804) map
I (319) esp_image: segment 2: paddr=0x0008f4d0 vaddr=0x3ffe8000 size=0x00644 (  1604) load
I (320) esp_image: segment 3: paddr=0x0008fb1c vaddr=0x40100000 size=0x00080 (   128) load
I (330) esp_image: segment 4: paddr=0x0008fba4 vaddr=0x40100080 size=0x05a4c ( 23116) load
I (351) boot: Loaded app from partition at offset 0x10000

Stack smashing protect failure!

abort() was called at PC 0x4021fd1a on core 0
0x4021fd1a: __stack_chk_fail at /path/to/ESP8266_RTOS_SDK/components/esp_common/src/stack_check.c:37

Guru Meditation Error: Core  0 panic'ed (StoreProhibited). Exception was unhandled.
Core 0 register dump:
PC      : 0x4022b6c6  PS      : 0x00000030  A0      : 0x4022b6c4  A1      : 0x3ffecb60  
0x4022b6c6: abort at /path/to/ESP8266_RTOS_SDK/components/newlib/src/syscall.c:69 (discriminator 1)

0x4022b6c4: abort at /path/to/ESP8266_RTOS_SDK/components/newlib/src/syscall.c:69 (discriminator 1)

A2      : 0x00000000  A3      : 0x550168da  A4      : 0x550168da  A5      : 0x00000001  
A6      : 0x00000000  A7      : 0x00000000  A8      : 0x00000000  A9      : 0x00000000  
A10     : 0x00000000  A11     : 0x00000000  A12     : 0x00000001  A13     : 0x00000000  
A14     : 0x00000000  A15     : 0x00000000  SAR     : 0x0000001e  EXCCAUSE: 0x0000001d  

Backtrace: 0x4022b6c6:0x3ffecb60 0x4021fd1d:0x3ffecb80 0x401005c2:0x3ffecb90 0x401005f6:0x3ffecbb0 0x4022283d:0x3ffecbd0 0x40222961:0x3ffecbf0 
0x4022b6c6: abort at /path/to/ESP8266_RTOS_SDK/components/newlib/src/syscall.c:69 (discriminator 1)

0x4021fd1d: __stack_chk_fail at ??:?

0x401005c2: vPortExitCritical at /path/to/ESP8266_RTOS_SDK/components/freertos/port/esp8266/port.c:271

0x401005f6: PendSV at /path/to/ESP8266_RTOS_SDK/components/freertos/port/esp8266/port.c:123

0x4022283d: prvProcessTimerOrBlockTask at /path/to/ESP8266_RTOS_SDK/components/freertos/freertos/timers.c:582

0x40222961: prvTimerTask at /path/to/ESP8266_RTOS_SDK/components/freertos/freertos/timers.c:533 (discriminator 1)

Steps to repropduce

  1. Clone the repository, set IDF_PATH to it. 
    git clone https://github.com/espressif/ESP8266_RTOS_SDK.git
cd ESP8266_RTOS_SDK
export IDF_PATH=$(pwd)
  2. Go into examples/mdns 
    cd examples/protocols/mdns
  3. Configure it, adding the desired wifi config and enabling stack protection mode to Overall or Strong: 
    make menuconfig
    Example Connection Configuration -> WiFi SSID
                             -> WiFi Password
Compiler options -> Stack smashing protection mode -> Overall

Code to reproduce this issue

mdns example

Debug Logs

See above (in actual behavior)

joshuacollins commented 2 years ago

Just wanted to +1 this - calling mdns_init() is all you need to trigger a crash when stack smashing protections are enabled - seeing the same with a very simple example.