From e649a3de7d853bf82a9105a2cb3869c7b8c96108 Mon Sep 17 00:00:00 2001 From: salmonik Date: Sun, 2 Aug 2026 22:46:59 +0200 Subject: v0.5.7: guard report 4-words-per-line — 16 stack words survive band hand-copy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The OptiPlex repro copies are truncated at the ~110-char band width, so the old single-line 'stk:' (12 words, >200 chars) lost the return chain after a few words. Split mem/stk dumps into 4-words-per-line blocks: mem+mem2 (8 words around the corruption) and stk..stk4 (16 words) — the drop caller chain now survives hand transcription. --- rsdos/src/main.rs | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 'rsdos') diff --git a/rsdos/src/main.rs b/rsdos/src/main.rs index cbbf2ba..806f150 100644 --- a/rsdos/src/main.rs +++ b/rsdos/src/main.rs @@ -344,9 +344,38 @@ pub unsafe extern "efiapi" fn efi_main(image_handle: Handle, system_table: *mut } else { rsnix::serial_println!("cursor: no mouse — overlay disabled"); } + // TEST HOOK: reproduce the OptiPlex '0xaaaaaa' uninit-drop crash in + // QEMU. The real hardware's stack carries 0xAA fill left by + // firmware; any shell value that is dropped without being written + // then frees garbage and trips the dealloc guard. Filling the + // shell's future stack region with 0xAA here makes the same bug + // visible on QEMU (serial + gdb available) instead of only on the + // OptiPlex. + stack_fill_aa(); shell::run(); } +/// Write 0xAA over the stack region the shell's frames will reuse, +/// leaving the current frames (top 4 KiB) intact. 128 KiB covers the +/// whole shell frame chain on QEMU and the OptiPlex. Best-effort: the +/// region is below rsp inside the boot stack mapping. +fn stack_fill_aa() { + let rsp: usize; + unsafe { + core::arch::asm!("mov {}, rsp", out(reg) rsp); + } + let top = rsp - 0x1000; + let bottom = rsp - 0x21000; + unsafe { + let mut p = bottom; + while p < top { + core::ptr::write_volatile(p as *mut u64, 0xAAAAAAAAAAAAAAAA); + p += 8; + } + } + rsnix::serial_println!("stack: 0xAA-fill 0x{:x}..0x{:x}", bottom, top); +} + // --------------------------------------------------------------------------- // Print a memory summary from the stashed memory map // --------------------------------------------------------------------------- -- cgit v1.2.3