Stack buffer overflow in riscv_debug.c when accessing 128-bit CSRs #2239

mTOTm commented 2026年04月26日 12:57:11 +02:00

Environment

• OS: Ubuntu 22.04
• BMDA Version: v2.0.0-534-g488f2f90-dirty
• Debug Probe: Black Magic Probe (ST-Link/v2)
• Target: HPM RISC-V chip (Andes Tech RISC-V DTM, ID: 0x1000563d)

Description

BMDA crashes with "stack smashing detected" when attempting to identify RISC-V targets
that have 4+ data registers, which triggers 128-bit CSR access mode.

Steps to Reproduce

1. Connect to an HPM RISC-V target via ST-Link v2
2. Run: ./build_stlink/blackmagic -tj
3. Crash occurs during target identification

log

./build_stlink/blackmagic -tj
Black Magic Debug App v2.0.0-530-g5057f2fd-dirty
 for Black Magic Probe, ST-Link v2 and v3, CMSIS-DAP, J-Link, FTDI (MPSSE) and WCH-Link
Using 1d50:6018 DFD496DE Black Magic Debug
 Black Magic Probe (ST-Link/v2) v2.0.0-503-gd8d74921-dirty
Running in Test Mode
Target voltage: 3.31V
Speed set to 6.000MHz for JTAG
Resetting TAP
Change state to Shift-DR
Scanning out ID codes
Return to Run-Test/Idle
Change state to Shift-IR
Scanning out IRs
Return to Run-Test/Idle
Change state to Shift-DR
Return to Run-Test/Idle
ID code 0x1000563d: Andes Tech RISC-V DTM.
RISC-V debug v0.13/v1.0 DMI
RISC-V debug v0.13 DM
Hart has 4 data registers and 8 progbuf registers
Attempting 128-bit read on misa
CSR access failed: 2
CSR access failed: 2
CSR access failed: 2
CSR access failed: 2
*** stack smashing detected ***: terminated
Aborted (core dumped)

### Environment - **OS**: Ubuntu 22.04 - **BMDA Version**: v2.0.0-534-g488f2f90-dirty - **Debug Probe**: Black Magic Probe (ST-Link/v2) - **Target**: HPM RISC-V chip (Andes Tech RISC-V DTM, ID: 0x1000563d) ### Description BMDA crashes with "stack smashing detected" when attempting to identify RISC-V targets that have 4+ data registers, which triggers 128-bit CSR access mode. ### Steps to Reproduce 1. Connect to an HPM RISC-V target via ST-Link v2 2. Run: `./build_stlink/blackmagic -tj` 3. Crash occurs during target identification ### log ```bash ./build_stlink/blackmagic -tj Black Magic Debug App v2.0.0-530-g5057f2fd-dirty for Black Magic Probe, ST-Link v2 and v3, CMSIS-DAP, J-Link, FTDI (MPSSE) and WCH-Link Using 1d50:6018 DFD496DE Black Magic Debug Black Magic Probe (ST-Link/v2) v2.0.0-503-gd8d74921-dirty Running in Test Mode Target voltage: 3.31V Speed set to 6.000MHz for JTAG Resetting TAP Change state to Shift-DR Scanning out ID codes Return to Run-Test/Idle Change state to Shift-IR Scanning out IRs Return to Run-Test/Idle Change state to Shift-DR Return to Run-Test/Idle ID code 0x1000563d: Andes Tech RISC-V DTM. RISC-V debug v0.13/v1.0 DMI RISC-V debug v0.13 DM Hart has 4 data registers and 8 progbuf registers Attempting 128-bit read on misa CSR access failed: 2 CSR access failed: 2 CSR access failed: 2 CSR access failed: 2 *** stack smashing detected ***: terminated Aborted (core dumped) ```