1.\" Copyright (c) 2006 Pawel Jakub Dawidek <pjd@FreeBSD.org> 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 13.\" THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND 14.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" 25.\" $FreeBSD$ 26.\" 27.Dd January 9, 2009 28.Dt REDZONE 9 29.Os 30.Sh NAME 31.Nm RedZone 32.Nd "buffer corruptions detector" 33.Sh SYNOPSIS 34.Cd "options KDB" 35.Cd "options DDB" 36.Cd "options DEBUG_REDZONE" 37.Sh DESCRIPTION 38.Nm 39detects buffer underflow and buffer overflow bugs at runtime. 40Currently 41.Nm 42only detects buffer corruptions for memory allocated with 43.Xr malloc 9 . 44When such corruption is detected two backtraces are printed on the console. 45The first one shows from where memory was allocated, the second one shows from 46where memory was freed. 47By default the system will not panic when buffer corruption is detected. 48This can be changed by setting the 49.Va vm.redzone.panic 50.Xr sysctl 8 51variable to 1. 52The amount of extra memory allocated for 53.Nm Ns 's 54needs is stored in the 55.Va vm.redzone.extra_mem 56.Xr sysctl 8 57variable. 58.Sh EXAMPLE 59The example below shows the logs from the detection of a buffer underflow and a 60buffer overflow. 61.Bd -literal -offset indent 62REDZONE: Buffer underflow detected. 2 bytes corrupted before 0xc8688580 (16 bytes allocated). 63Allocation backtrace: 64#0 0xc0583e4e at redzone_setup+0x3c 65#1 0xc04a23fa at malloc+0x19e 66#2 0xcdeb69ca at redzone_modevent+0x60 67#3 0xc04a3f3c at module_register_init+0x82 68#4 0xc049d96a at linker_file_sysinit+0x8e 69#5 0xc049dc7c at linker_load_file+0xed 70#6 0xc04a041f at linker_load_module+0xc4 71#7 0xc049e883 at kldload+0x116 72#8 0xc05d9b3d at syscall+0x325 73#9 0xc05c944f at Xint0x80_syscall+0x1f 74Free backtrace: 75#0 0xc0583f92 at redzone_check+0xd4 76#1 0xc04a2422 at free+0x1c 77#2 0xcdeb69a6 at redzone_modevent+0x3c 78#3 0xc04a438d at module_unload+0x61 79#4 0xc049e0b3 at linker_file_unload+0x89 80#5 0xc049e979 at kern_kldunload+0x96 81#6 0xc049ea00 at kldunloadf+0x2c 82#7 0xc05d9b3d at syscall+0x325 83#8 0xc05c944f at Xint0x80_syscall+0x1f 84 85REDZONE: Buffer overflow detected. 4 bytes corrupted after 0xc8688590 (16 bytes allocated). 86Allocation backtrace: 87#0 0xc0583e4e at redzone_setup+0x3c 88#1 0xc04a23fa at malloc+0x19e 89#2 0xcdeb69ca at redzone_modevent+0x60 90#3 0xc04a3f3c at module_register_init+0x82 91#4 0xc049d96a at linker_file_sysinit+0x8e 92#5 0xc049dc7c at linker_load_file+0xed 93#6 0xc04a041f at linker_load_module+0xc4 94#7 0xc049e883 at kldload+0x116 95#8 0xc05d9b3d at syscall+0x325 96#9 0xc05c944f at Xint0x80_syscall+0x1f 97Free backtrace: 98#0 0xc0584020 at redzone_check+0x162 99#1 0xc04a2422 at free+0x1c 100#2 0xcdeb69a6 at redzone_modevent+0x3c 101#3 0xc04a438d at module_unload+0x61 102#4 0xc049e0b3 at linker_file_unload+0x89 103#5 0xc049e979 at kern_kldunload+0x96 104#6 0xc049ea00 at kldunloadf+0x2c 105#7 0xc05d9b3d at syscall+0x325 106#8 0xc05c944f at Xint0x80_syscall+0x1f 107.Ed 108.Sh SEE ALSO 109.Xr sysctl 8 , 110.Xr malloc 9 , 111.Xr memguard 9 112.Sh HISTORY 113.Nm 114first appeared in 115.Fx 7.0 . 116.Sh AUTHORS 117.An Pawel Jakub Dawidek Aq Mt pjd@FreeBSD.org 118.Sh BUGS 119Currently, 120.Nm 121does not cooperate with 122.Xr memguard 9 . 123Allocations from a memory type controlled by 124.Xr memguard 9 125are simply skipped, so buffer corruptions will not be detected there. 126