Understanding Hardware-Enforced Stack Protection

Re:Understanding Hardware-Enforced Stack Protection by Taniwha on Friday March 27, 2020 @02:52AM (#22700866)

I was thinking about this the other day, wondering why modern RISC machines (like RISC-V). that don't have call/return instructions that hard code stack direction, simply have coding models that grow their stacks upwards - this would avoid most of these sorts of problems

[ Parent | on HN ]

Re:Understanding Hardware-Enforced Stack Protection by dhhwrongagain on Friday March 27, 2020 @04:09AM (#22701133)

Yeah that’s a very good point.

There may be multiple reasons but a performance reason of which I’m aware is downward stacks are more efficient for allocating aligned memory:

    sp = (sp - size) & align;

That’s only two instructions, with a stack that grows upward:

    sp += size;
    if (sp & (align - 1))
      sp += align - (sp & (align - 1));

Which is a few more instructions. Of course you can alleviate this by requiring an alignment invariant in the ABI, which is usually done anyway.

[ Parent | on HN ]

Re:Understanding Hardware-Enforced Stack Protection by nayuki on Friday March 27, 2020 @10:00AM (#22702867)

The classical reason why stacks grow downward is because heaps grow upward. This arrangement maximizes the usefulness of the virtual address space in a single-threaded process.

[ Parent | on HN ]

Re:Understanding Hardware-Enforced Stack Protection by Taniwha on Saturday March 28, 2020 @12:25AM (#22709214)

well stacks typically grew downwards even before there were heaps (but not always - Burroughs large systems for example)

Heaps of course can grow downwards

With modern 64-bit address spaces actual running out of space is not an issue (especially since we're dynamically moving around code, heaps and stacks for security reasons anyway)

[ Parent | on HN ]

Re:Understanding Hardware-Enforced Stack Protection by techslave on Sunday March 29, 2020 @12:51PM (#22720463)

i’ve often wondered this. but wrt ROP sled, does it matter? instead of overwriting “this” stack frame’s ret address, you’d overwrite the previous. the effect would be seen when your caller returns instead of when you return.

[ Parent | on HN ]