From 89e2f00dadd70ecff3a4f490f8d04c87750b4a0d Mon Sep 17 00:00:00 2001
From: "chao.an" <anchao@xiaomi.com>
Date: Thu, 2 Dec 2021 17:44:49 +0800
Subject: [PATCH] arch/assert: fix the stack dump overflow

[ EMERG] kasan_report: kasan detected a read access error, address at 0x3c24fca8, size is 4
[ EMERG] up_assert: Assertion failed at file:kasan/kasan.c line: 104 task: init
[ EMERG] backtrace|10:  0x2c334666 0x2c35f0d6 0x2c359ef6 0x2c35f830 0x2c360ed4 0x2c3615c0 0x2c324e0c 0x2c30a168
[ EMERG] up_registerdump: R0: ffffffff R1: 00000004 R2: ffffffff R3: ffffffff
[ EMERG] up_registerdump: R4: 3c20d4f0 R5: 2c35acd5 R6: 00000000 FP: 3c24fae8
[ EMERG] up_registerdump: R8: 3c20d504 SB: ffffffff SL: 2c413e7c R11: 2c411eb8
[ EMERG] up_registerdump: IP: 00000002 SP: 3c24fae8 LR: 00000003 PC: 2c35f0d6
[ EMERG] up_registerdump: xPSR: 61010000 BASEPRI: 000000e0 CONTROL: 00000004

Signed-off-by: chao.an <anchao@xiaomi.com>
---
 arch/arm/src/arm/arm_assert.c              | 2 +-
 arch/arm/src/armv6-m/arm_assert.c          | 2 +-
 arch/arm/src/armv7-a/arm_assert.c          | 2 +-
 arch/arm/src/armv7-m/arm_assert.c          | 2 +-
 arch/arm/src/armv7-r/arm_assert.c          | 2 +-
 arch/arm/src/armv8-m/arm_assert.c          | 2 +-
 arch/avr/src/avr/up_dumpstate.c            | 2 +-
 arch/avr/src/avr32/up_dumpstate.c          | 2 +-
 arch/hc/src/m9s12/m9s12_assert.c           | 2 +-
 arch/mips/src/mips32/mips_dumpstate.c      | 2 +-
 arch/misoc/src/lm32/lm32_dumpstate.c       | 2 +-
 arch/misoc/src/minerva/minerva_dumpstate.c | 2 +-
 arch/or1k/src/common/up_assert.c           | 2 +-
 arch/risc-v/src/rv64gc/riscv_assert.c      | 2 +-
 arch/x86/src/common/up_assert.c            | 2 +-
 arch/x86_64/src/common/up_assert.c         | 2 +-
 16 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/arch/arm/src/arm/arm_assert.c b/arch/arm/src/arm/arm_assert.c
index fe6fa51370..e2be7da0e1 100644
--- a/arch/arm/src/arm/arm_assert.c
+++ b/arch/arm/src/arm/arm_assert.c
@@ -77,7 +77,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
diff --git a/arch/arm/src/armv6-m/arm_assert.c b/arch/arm/src/armv6-m/arm_assert.c
index c89ec728a3..547ad5da8c 100644
--- a/arch/arm/src/armv6-m/arm_assert.c
+++ b/arch/arm/src/armv6-m/arm_assert.c
@@ -76,7 +76,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
diff --git a/arch/arm/src/armv7-a/arm_assert.c b/arch/arm/src/armv7-a/arm_assert.c
index 2388c207c8..67bd0de0be 100644
--- a/arch/arm/src/armv7-a/arm_assert.c
+++ b/arch/arm/src/armv7-a/arm_assert.c
@@ -79,7 +79,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
diff --git a/arch/arm/src/armv7-m/arm_assert.c b/arch/arm/src/armv7-m/arm_assert.c
index f2340b2e4a..f0318ecdaf 100644
--- a/arch/arm/src/armv7-m/arm_assert.c
+++ b/arch/arm/src/armv7-m/arm_assert.c
@@ -79,7 +79,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
diff --git a/arch/arm/src/armv7-r/arm_assert.c b/arch/arm/src/armv7-r/arm_assert.c
index 7742c4d226..05b1d7a72a 100644
--- a/arch/arm/src/armv7-r/arm_assert.c
+++ b/arch/arm/src/armv7-r/arm_assert.c
@@ -76,7 +76,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
diff --git a/arch/arm/src/armv8-m/arm_assert.c b/arch/arm/src/armv8-m/arm_assert.c
index 6a43edeac1..30ef42d220 100644
--- a/arch/arm/src/armv8-m/arm_assert.c
+++ b/arch/arm/src/armv8-m/arm_assert.c
@@ -79,7 +79,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
diff --git a/arch/avr/src/avr/up_dumpstate.c b/arch/avr/src/avr/up_dumpstate.c
index c246c554da..aac8edd330 100644
--- a/arch/avr/src/avr/up_dumpstate.c
+++ b/arch/avr/src/avr/up_dumpstate.c
@@ -51,7 +51,7 @@ static void up_stackdump(uint16_t sp, uint16_t stack_top)
 {
   uint16_t stack;
 
-  for (stack = sp & ~3; stack < stack_top; stack += 12)
+  for (stack = sp & ~3; stack < (stack_top & ~0x1f); stack += 12)
     {
       uint8_t *ptr = (uint8_t *)stack;
       _alert("%04x: %02x %02x %02x %02x %02x %02x %02x %02x"
diff --git a/arch/avr/src/avr32/up_dumpstate.c b/arch/avr/src/avr32/up_dumpstate.c
index c47b343e01..3384a85226 100644
--- a/arch/avr/src/avr32/up_dumpstate.c
+++ b/arch/avr/src/avr32/up_dumpstate.c
@@ -51,7 +51,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
diff --git a/arch/hc/src/m9s12/m9s12_assert.c b/arch/hc/src/m9s12/m9s12_assert.c
index 2717252a84..02b25319c2 100644
--- a/arch/hc/src/m9s12/m9s12_assert.c
+++ b/arch/hc/src/m9s12/m9s12_assert.c
@@ -76,7 +76,7 @@ static void up_stackdump(uint16_t sp, uint16_t stack_top)
 {
   uint16_t stack;
 
-  for (stack = sp; stack < stack_top; stack += 16)
+  for (stack = sp; stack < (stack_top & ~0x1f); stack += 16)
     {
       uint8_t *ptr = (uint8_t *)stack;
 
diff --git a/arch/mips/src/mips32/mips_dumpstate.c b/arch/mips/src/mips32/mips_dumpstate.c
index 7abbde6a2f..07bec6354f 100644
--- a/arch/mips/src/mips32/mips_dumpstate.c
+++ b/arch/mips/src/mips32/mips_dumpstate.c
@@ -52,7 +52,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08" PRIx32 ": %08" PRIx32 " %08" PRIx32
diff --git a/arch/misoc/src/lm32/lm32_dumpstate.c b/arch/misoc/src/lm32/lm32_dumpstate.c
index 06b3ab8ea5..ec69734244 100644
--- a/arch/misoc/src/lm32/lm32_dumpstate.c
+++ b/arch/misoc/src/lm32/lm32_dumpstate.c
@@ -50,7 +50,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
diff --git a/arch/misoc/src/minerva/minerva_dumpstate.c b/arch/misoc/src/minerva/minerva_dumpstate.c
index 46f133cfa2..d3fd061456 100644
--- a/arch/misoc/src/minerva/minerva_dumpstate.c
+++ b/arch/misoc/src/minerva/minerva_dumpstate.c
@@ -50,7 +50,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *) stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
diff --git a/arch/or1k/src/common/up_assert.c b/arch/or1k/src/common/up_assert.c
index 182c124c20..0b239279f7 100644
--- a/arch/or1k/src/common/up_assert.c
+++ b/arch/or1k/src/common/up_assert.c
@@ -75,7 +75,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
diff --git a/arch/risc-v/src/rv64gc/riscv_assert.c b/arch/risc-v/src/rv64gc/riscv_assert.c
index a9d5768620..f337a4fdb4 100644
--- a/arch/risc-v/src/rv64gc/riscv_assert.c
+++ b/arch/risc-v/src/rv64gc/riscv_assert.c
@@ -75,7 +75,7 @@ static void up_stackdump(uint64_t sp, uintptr_t stack_top)
 {
   uintptr_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08" PRIxPTR ": %08" PRIx32 " %08" PRIx32 " %08" PRIx32
diff --git a/arch/x86/src/common/up_assert.c b/arch/x86/src/common/up_assert.c
index 627fa1e1d5..18ddacca6d 100644
--- a/arch/x86/src/common/up_assert.c
+++ b/arch/x86/src/common/up_assert.c
@@ -77,7 +77,7 @@ static void up_stackdump(uint32_t sp, uint32_t stack_top)
 {
   uint32_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
diff --git a/arch/x86_64/src/common/up_assert.c b/arch/x86_64/src/common/up_assert.c
index cce56be1d3..eebca3e34a 100644
--- a/arch/x86_64/src/common/up_assert.c
+++ b/arch/x86_64/src/common/up_assert.c
@@ -69,7 +69,7 @@ static void up_stackdump(uint64_t sp, uint64_t stack_top)
 {
   uint64_t stack;
 
-  for (stack = sp & ~0x1f; stack < stack_top; stack += 32)
+  for (stack = sp & ~0x1f; stack < (stack_top & ~0x1f); stack += 32)
     {
       uint32_t *ptr = (uint32_t *)stack;
       _alert("%08x: %08x %08x %08x %08x %08x %08x %08x %08x\n",