Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x86 thread stack guards persist after thread exit #29499

Closed
andrewboie opened this issue Oct 23, 2020 · 1 comment
Closed

x86 thread stack guards persist after thread exit #29499

andrewboie opened this issue Oct 23, 2020 · 1 comment
Assignees
Labels
area: Memory Protection bug The issue is a bug, or the PR is fixing a bug priority: low Low impact/importance bug Stale

Comments

@andrewboie
Copy link
Contributor

andrewboie commented Oct 23, 2020

Describe the bug
If CONFIG_HW_STACK_PROTECTION is enabled on x86, a page within every thread stack is marked read-only to serve as an overflow guard when the thread is initialized. This page is immediately below the stack buffer; if the stack overflows, writes to it produce an exception.

When the thread exits, the page is left with read-only access permissions.

To Reproduce
Code inspection.

Expected behavior
Any pages in a thread stack object should revert to their original mapping permissions when the thread exits.

Impact
If the memory for the stack object is only used as a stack object, there is no impact.
If the memory for the stack object is returned to a heap after the thread exits, this could cause unexpected faults when that memory is used for some other purpose.

Dynamic heaps have not historically been supported (for a long time there had been no allocator that supported alignment, or a generic way to know the alignment of stack objects) but there is some work going on in this area.

My preferred way of fixing this is to stop using physical pages for guards and memory-map stacks instead: #28899

@andrewboie andrewboie added bug The issue is a bug, or the PR is fixing a bug priority: low Low impact/importance bug area: Memory Protection labels Oct 23, 2020
@andrewboie andrewboie self-assigned this Oct 23, 2020
@github-actions
Copy link

This issue has been marked as stale because it has been open (more than) 60 days with no activity. Remove the stale label or add a comment saying that you would like to have the label removed otherwise this issue will automatically be closed in 14 days. Note, that you can always re-open a closed issue at any time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: Memory Protection bug The issue is a bug, or the PR is fixing a bug priority: low Low impact/importance bug Stale
Projects
None yet
Development

No branches or pull requests

1 participant