Detection

How do operating systems detect an overflow in the user space program stack [and then send SIGTERM or SIGSEGV to these user space programs]?

+6
source share
3 answers

The answer will depend on the target architecture and specific OS. Since the question is marked as Linux, you are fairly biased in asking a question that at first glance seems more general.

In a complex OS or RTOS, such as Linux or QNX Neutrino, with support for MMU protection, memory protection mechanisms such as the previously mentioned protection pages can be used. Such OSs require, of course, goals with an MMU.

Simpler operating systems and typical RTOS scheduling kernels without MMU support can use a number of methods. The simplest thing is to place a protective signature at the top of the stack, which is checked for modification when the scheduler starts. This is a bit-and-miss, it requires that the stack overflow actually changes the signature, and that the damage received does not cause a crash before the next scheduler starts. Some systems with built-in debugging resources may place an access breakpoint in the signature word and throw an exception when it hits.

In development, a common method is to first populate each stream stack with a signature and periodically check the stream for a "high level" and issue a warning if it exceeds a certain percentage level.

+7
source

Pages of protection. When the OS creates a stack for the program, it allocates a little more than indicated. The memory is allocated on the pages (usually 4 KB each), and the additional page will have such settings that any attempt to access it will throw an exception.

+10
source

Like the protective pages mentioned in another answer, some small (non-MMU) embedded microcontrollers have special exceptions for (and downstream).

+5
source

Source: https://habr.com/ru/post/899649/


All Articles