fix(unwinder): Guard invalid ARM32 instruction pointers - #1977
Merged
Conversation
On ARM32, unw_step first asks libunwind whether the current frame is a signal frame. The vendored implementation answers that by reading an instruction directly from the cursor's initial IP. Its local address-space validation is enabled only after this probe, so an unmapped IP faults inside the crash handler instead of returning an unwind error. This surfaced when unrelated stack-layout changes made the handler fallback produce 0x10c as its initial IP. No attachment code ran on that path; the changed layout only exposed the unwinder's unchecked read. The resulting SIGSEGV recursively entered the crash handler and prevented the original abort from being captured. Check /proc/self/maps before calling unw_step. Keep the initial frame, as the existing invalid-stack-pointer path does, but stop the walk before libunwind can dereference an unmapped address. Cover the failure with an ARM32 context whose initial IP is intentionally unmapped.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #1977 +/- ##
==========================================
+ Coverage 74.19% 74.35% +0.16%
==========================================
Files 104 104
Lines 25634 25638 +4
Branches 4626 4627 +1
==========================================
+ Hits 19018 19062 +44
+ Misses 5317 5272 -45
- Partials 1299 1304 +5 🚀 New features to boost your workflow:
|
JoshuaMoelans
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On ARM32,
unw_stepfirst askslibunwindwhether the current frame is a signal frame. The vendored implementation answers that by reading an instruction directly from the cursor's initial IP. Its local address-space validation is enabled only after this probe, so an unmapped IP faults inside the crash handler instead of returning an unwind error.This surfaced when unrelated stack-layout changes in #1974 made the handler fallback produce
0x10cas its initial IP. No attachment code ran on that path; the changed layout only exposed the unwinder's unchecked read. The resultingSIGSEGVrecursively entered the crash handler and prevented the original abort from being captured.Check
/proc/self/mapsbefore callingunw_step. Keep the initial frame, as the existing invalid-stack-pointer path does, but stop the walk beforelibunwindcan dereference an unmapped address. Cover the failure with an ARM32 context whose initial IP is intentionally unmapped.