Comment by Joker_vD
5 hours ago
I wonder how Linux manages without explicit _chkstk? In my experience, it feels like MAP_GROWSDOWN regions have way more than 1 guard page below its start — I can poke like a megabyte lower than its start, and the kernel will grow the memory region into there just fine.
It doesn't. This causes the StackClash vulnerability.
https://news.ycombinator.com/item?id=49343032
Preventing stack guard-page hopping - https://lwn.net/Articles/725832/
According to this article, allocation in page sizes with implicit probing is used;
Stack clash mitigation in GCC, Part 3 (-fstack-clash-protection option) - https://developers.redhat.com/blog/2020/05/22/stack-clash-mi...
Thank you for the context. But still.
You have a desirable performance optimization feature —used in every Linux program— that happens to interfere with a lousy exploit mitigation.
No one should ever need more than 64kBs for a stack anyways.
> No one should ever need more than 64kBs for a stack anyways.
Well, if people would stop storing anything except than return addresses on the stack, yeah, probably even 32 KiB of stack would be enough for anyone. It'd also single-handedly stop all kinds of stack-smashing attacks, too: can't overwrite a return address on the stack if nothing stores data on the stack except the CALL/RET instructions.
Unfortunately, the current zeitgeist is still to have "writeable stacks" which are only moderately less horrible for the security than "executable stacks".