diff --git a/kernel/src/arch/riscv32/compiler_rt.rs b/kernel/src/arch/riscv32/compiler_rt.rs
index 432f0ef..80dbdf8 100644
--- a/kernel/src/arch/riscv32/compiler_rt.rs
+++ b/kernel/src/arch/riscv32/compiler_rt.rs
@@ -51,23 +51,22 @@ pub unsafe extern fn __atomic_store_4(dst: *mut u32, val: u32) {
     write(dst, val)
 }
 
-unsafe fn __atomic_compare_exchange<T: PartialEq>(dst: *mut T, old: T, new: T) -> (T, bool) {
+unsafe fn __atomic_compare_exchange<T: PartialEq>(dst: *mut T, expected: *mut T, desired: T) -> bool {
     use super::interrupt;
     let flags = interrupt::disable_and_store();
-    let ret = read(dst);
-    if ret == old {
-        write(dst, new);
-    }
+    let val = read(dst);
+    let success = val == read(expected);
+    write(dst, if success {desired} else {val});
     interrupt::restore(flags);
-    (ret, true)
+    success
 }
 
 #[no_mangle]
-pub unsafe extern fn __atomic_compare_exchange_1(dst: *mut u8, old: u8, src: u8) -> (u8, bool) {
-    __atomic_compare_exchange(dst, old, src)
+pub unsafe extern fn __atomic_compare_exchange_1(dst: *mut u8, expected: *mut u8, desired: u8) -> bool {
+    __atomic_compare_exchange(dst, expected, desired)
 }
 
 #[no_mangle]
-pub unsafe extern fn __atomic_compare_exchange_4(dst: *mut u32, old: u32, src: u32) -> (u32, bool) {
-    __atomic_compare_exchange(dst, old, src)
+pub unsafe extern fn __atomic_compare_exchange_4(dst: *mut u32, expected: *mut u32, desired: u32) -> bool {
+    __atomic_compare_exchange(dst, expected, desired)
 }
\ No newline at end of file
diff --git a/kernel/src/arch/riscv32/memory.rs b/kernel/src/arch/riscv32/memory.rs
index 4945b26..7ec687c 100644
--- a/kernel/src/arch/riscv32/memory.rs
+++ b/kernel/src/arch/riscv32/memory.rs
@@ -22,8 +22,8 @@ fn init_frame_allocator() {
     use consts::{MEMORY_OFFSET, MEMORY_END};
 
     let mut ba = FRAME_ALLOCATOR.lock();
-
-    ba.insert(to_range(end as usize, MEMORY_END));
+    use consts::{KERNEL_HEAP_OFFSET, KERNEL_HEAP_SIZE};
+    ba.insert(to_range(KERNEL_HEAP_OFFSET + KERNEL_HEAP_SIZE, MEMORY_END));
     info!("FrameAllocator init end");
 
     fn to_range(start: usize, end: usize) -> Range<usize> {
@@ -46,7 +46,7 @@ fn remap_the_kernel() {
     ms.push(MemoryArea::new_identity(sdata as usize, edata as usize, MemoryAttr::default(), "data"));
     ms.push(MemoryArea::new_identity(srodata as usize, erodata as usize, MemoryAttr::default().readonly(), "rodata"));
     ms.push(MemoryArea::new_identity(sbss as usize, ebss as usize, MemoryAttr::default(), "bss"));
-    ms.push(MemoryArea::new(KERNEL_HEAP_OFFSET, KERNEL_HEAP_OFFSET + KERNEL_HEAP_SIZE, MemoryAttr::default(), "kernel_heap"));
+    ms.push(MemoryArea::new_identity(KERNEL_HEAP_OFFSET, KERNEL_HEAP_OFFSET + KERNEL_HEAP_SIZE, MemoryAttr::default(), "kernel_heap"));
     unsafe { ms.activate(); }
     use core::mem::forget;
     forget(ms);
diff --git a/kernel/src/fs.rs b/kernel/src/fs.rs
index c573623..8262467 100644
--- a/kernel/src/fs.rs
+++ b/kernel/src/fs.rs
@@ -30,7 +30,12 @@ pub fn shell() {
     let files = root.borrow().list().unwrap();
     println!("Available programs: {:?}", files);
 
-    let mut buf = Box::new([0; 64 << 12]);
+    // Avoid stack overflow in release mode
+    // Equal to: `buf = Box::new([0; 64 << 12])`
+    use alloc::alloc::{alloc, dealloc, Layout};
+    const BUF_SIZE: usize = 0x40000;
+    let layout = Layout::from_size_align(BUF_SIZE, 0x1000).unwrap();
+    let buf = unsafe{ slice::from_raw_parts_mut(alloc(layout), BUF_SIZE) };
     loop {
         print!(">> ");
         use console::get_line;
@@ -47,6 +52,7 @@ pub fn shell() {
             println!("Program not exist");
         }
     }
+    unsafe { dealloc(buf.as_mut_ptr(), layout) };
 }
 
 struct MemBuf(&'static [u8]);
diff --git a/kernel/src/memory.rs b/kernel/src/memory.rs
index cd4d17c..0da3fb3 100644
--- a/kernel/src/memory.rs
+++ b/kernel/src/memory.rs
@@ -26,14 +26,9 @@ pub fn dealloc_frame(target: usize) {
 
 // alloc from heap
 pub fn alloc_stack() -> Stack {
-    use alloc::boxed::Box;
+    use alloc::alloc::{alloc, Layout};
     const STACK_SIZE: usize = 0x8000;
-    // FIXME: This alignment will cause rsp align with 0x8000 in x86_64 release mode.
-    //        Because kernel stack is not large enough, it will trigger double fault.
-    #[repr(align(0x8000))]
-    struct StackData([u8; STACK_SIZE]);
-    let data = Box::new(StackData([0; STACK_SIZE]));
-    let bottom = Box::into_raw(data) as usize;
+    let bottom = unsafe{ alloc(Layout::from_size_align(STACK_SIZE, 0x8000).unwrap()) } as usize;
     let top = bottom + STACK_SIZE;
     Stack { top, bottom }
 }