CoAP utils (coap_utils.h) cause stack overflow

[Pwntus]

Hi,

The situation is very simple; I try to use the CoAP Utils library to simplify CoAP usage in an application running on the nRF9160 DK (https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/include/net/coap_utils.html)

When I run the program and it reaches coap_init(AF_INET) I get a stack overflow issue in the output. I suspect there is a Zephyr stack config I need to set in order to avoid this issue. I can see that a stack size is defined in CoAP utils, here: https://github.com/nrfconnect/sdk-nrf/blob/master/subsys/net/lib/coap_utils/coap_utils.c#L27

...but I'm unable to figure out why I get this stack overflow issue at runtime.

Here is a more detailed debug output:

[00:00:10.980,590] [1;31m<err> os: ***** HARD FAULT *****[0m
[00:00:10.980,590] [1;31m<err> os:   Fault escalation (see below)[0m
[00:00:10.980,590] [1;31m<err> os: ***** USAGE FAULT *****[0m
[00:00:10.980,590] [1;31m<err> os:   Stack overflow (context area not valid)[0m
[00:00:10.980,621] [1;31m<err> os: r0/a1:  0xffffffff  r1/a2:  0x0002f661  r2/a3:  0xffffffff[0m
[00:00:10.980,621] [1;31m<err> os: r3/a4:  0xffffffff r12/ip:  0xffffffff r14/lr:  0x20028ff8[0m
[00:00:10.980,621] [1;31m<err> os:  xpsr:  0x00036a00[0m
[00:00:10.980,651] [1;31m<err> os: s[ 0]:  0x00000000  s[ 1]:  0x00000000  s[ 2]:  0x00000000  s[ 3]:  0x00000000[0m
[00:00:10.980,651] [1;31m<err> os: s[ 4]:  0x00000000  s[ 5]:  0x00000000  s[ 6]:  0x00000000  s[ 7]:  0x00000000[0m
[00:00:10.980,682] [1;31m<err> os: s[ 8]:  0x00000000  s[ 9]:  0x00000000  s[10]:  0x00000000  s[11]:  0x00000000[0m
[00:00:10.980,682] [1;31m<err> os: s[12]:  0x00000000  s[13]:  0x00000000  s[14]:  0x00000000  s[15]:  0x00000000[0m
[00:00:10.980,682] [1;31m<err> os: fpscr:  0x00000000[0m
[00:00:10.980,712] [1;31m<err> os: Faulting instruction address (r15/pc): 0x00000000[0m
[00:00:10.980,712] [1;31m<err> os: >>> ZEPHYR FATAL ERROR 2: Stack overflow on CPU 0[0m
[00:00:10.980,712] [1;31m<err> os: Current thread: 0x200218e0 (unknown)[0m
[00:00:11.117,523] [1;31m<err> os: Halting system[0m

I currently use the following configs in prj.conf:

CONFIG_HEAP_MEM_POOL_SIZE=16384
CONFIG_MAIN_STACK_SIZE=8192
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=8192
CONFIG_HW_STACK_PROTECTION=y

Thanks!

[Pwntus]

I've traced the faulting address 29376 in build/zephyr/zephyr.lst: 

static inline int nrf91_socket_offload_poll(struct pollfd *fds, int nfds,
					    int timeout)
{
   29374:	b580      	push	{r7, lr}
   29376:	b098      	sub	sp, #96	; 0x60 <------ here
   29378:	af00      	add	r7, sp, #0
   2937a:	60f8      	str	r0, [r7, #12]
   2937c:	60b9      	str	r1, [r7, #8]
   2937e:	607a      	str	r2, [r7, #4]
	int retval = 0;
	
	...

...which points me to the nRF implementation of BSD sockets: https://github.com/nrfconnect/sdk-nrf/blob/master/lib/bsdlib/nrf91_sockets.c#L862

I do however suspect the issue is with the stack size of the current thread used by the socket, which in this case appears to be listening/polling.

Thankful for any input.

[Pwntus]

All the clues point me to this #define: https://github.com/nrfconnect/sdk-nrf/blob/master/subsys/net/lib/coap_utils/coap_utils.c#L20

I manually doubled the stack size (500 > 1000) and voilà, it works!

I don't know why 500 is the configured size, maybe this is a bug?

[Øyvind]

Hi Pontus, 

Happy to hear that you found the solution. Regarding if this is a bug I don't know at the moment. I have forwarded your question to our R&D department and will get back to you within today.

Kind regards,
Øyvind

[Øyvind]

I see that R&D has already given an answer to your PR (https://github.com/nrfconnect/sdk-nrf/pull/2451)

Thanks for spotting this, we've only tested the library with Zephyr native networking stack so far, so the issue was not spotted with bsdlib.

Kind regards,
Øyvind