Comment by rramadass
5 hours ago
Related to the above, two important concepts to know w.r.t a stack are "Red Zone" and "Guard Pages".
Raymond Chen again;
Why do we even need to define a red zone? Can’t I just use my stack for anything? - https://devblogs.microsoft.com/oldnewthing/20190111-00/?p=10...
A closer look at the stack guard page - https://devblogs.microsoft.com/oldnewthing/20220203-00/?p=10...
I wonder how Linux manages without explicit _chkstk? In my experience, it feels like MAP_GROWSDOWN regions have way more than 1 guard page below its start — I can poke like a megabyte lower than its start, and the kernel will grow the memory region into there just fine.
It doesn't. This causes the StackClash vulnerability.
https://news.ycombinator.com/item?id=49343032
Preventing stack guard-page hopping - https://lwn.net/Articles/725832/
According to this article, allocation in page sizes with implicit probing is used;
Stack clash mitigation in GCC, Part 3 (-fstack-clash-protection option) - https://developers.redhat.com/blog/2020/05/22/stack-clash-mi...
Thank you for the context. But still.
You have a desirable performance optimization feature —used in every Linux program— that happens to interfere with a lousy exploit mitigation.
No one should ever need more than 64kBs for a stack anyways.
1 reply →