Max D. (Jul 15 2026 at 14:01): Max D. (Jul 15 2026 at 14:01):Hello, I have found a bug in the stackswitching implementation for riscv32imac.
There, registers are being saved to the stack before switching the stack. In the saving routine, the registers' values are first written to the stack below the stack pointer and then the stack pointer is decreased. This leads to an issue if the stack switching process is interrupted after some registers have been saved to the stack already but the stack pointer has not been decreased yet.
Something like an interrupt handler could get control in the middle of the stack switching routine, write its own data below the current stack pointer (possibly overwriting data written during stack switching). When control goes back to the stack switching implementation, the previously saved values are lost. This will lead to incorrect values being loaded into registers once the switch back is made. I was able to produce this bug by having a Wasm program call async bindings very often and using fuel instrumentation with a fuel_async_yield_interval of 1.
I have opened a Pull Request with a fix for riscv32imac (which I was only able to test on an older version of Wasmtime, see the PR). I however also expect this bug to be present in other stackswitching implementations, but I do not have the hardware available to test a potential fix:
Alex Crichton (Jul 15 2026 at 15:17):Thanks! I've filed issues for those other architectures
Last updated: Jul 29 2026 at 05:03 UTC