KR20080066459A - Apparatus and method for dynamic detection of kernel stack overflow on operating system - Google Patents

Abstract

A device and a method for detecting kernel stack overflow in an OS(Operating System) are provided to detect the kernel stack overflow by adding a protected area at the last part of a stack area allocated in a fixed size, and inducing page fault when a stack pointer enters the protected area. A kernel stack manager(310) initializes a stack by adding a protected area at the end part of a stack area when a kernel stack is generated. A page fault handler(320) outputs an error message when a page fault exception is generated when overflow occurs in the kernel stack. A virtual memory manager(330) manages addressing a memory used by the kernel and addressing the kernel stack. A page frame allocator(340) manages the memory in a page unit, and maps the memory to a virtual memory when the memory is allocated. The protected area of the stack area is allocated in one page unit and is initialized in a state that a physical page is not allocated.

Description

Apparatus and method for dynamic detection of kernel stack overflow on Operating System}

1 is a diagram showing a kernel system configuration in a conventional computer operating system.

2 is a diagram illustrating the operation of a kernel system in a conventional computer operating system.

3 is a diagram illustrating components for memory management of a kernel system in a computer operating system according to an embodiment of the present invention.

4 illustrates the operation of a kernel system in a computer operating system in accordance with an embodiment of the present invention.

5 is a flowchart of a memory management method of a kernel system in a computer operating system according to an exemplary embodiment of the present invention.

<Explanation of symbols on main parts of the drawings>

310: kernel stack manager 320: page fault handler

330: virtual memory manager 340: page frame allocator

The present invention relates to an apparatus and method for dynamically detecting kernel mode stack overflow in a computer operating system. More particularly, the present invention relates to a kernel stack overflow in an operating system having a fixed size kernel stack. An apparatus and method for detecting a kernel mode stack overflow of a computer operating system in which a memory panic occurs and a kernel panic occurs.

An operating system (OS) is a set of programs that provides an interface for a user to use hardware more easily in a computer device such as a personal computer (PC), and includes a processor, a memory device, an input / output device, and a communication device. Manage resources such as devices and data.

The kernel is at the heart of this operating system. The kernel has a closed I / O operation, an interrupt handler that handles all requests that competitively require the services of the kernel, a scheduler that determines which programs share the kernel's processing time in what order, and when each schedule actually finishes each process. It may include a device for granting the right to use the computer. The kernel also has a memory manager that manages the operating system's address space in memory or storage and distributes it to all peripherals and other users of the kernel's services.

1 is a diagram illustrating a kernel system configuration in a conventional computer operating system.

As shown, the entire computer system can be largely divided into a user space and a kernel space.

In the user area, a user application (task) runs.

The kernel area divides subsystems such as task management, memory management, file system, and device control. They take control of the hardware and provide the services necessary for the application to run. The functions provided in the kernel area are configured in the form of system service application programming interfaces (APIs) and used by the application.

2 is a diagram illustrating the operation of a kernel system in a conventional computer operating system.

As shown, the kernel stack manager creates and initializes a kernel stack region in the virtual address space.

The kernel uses a virtual address space, which is largely divided into a kernel space and a user space.

Stack areas are also allocated on the virtual address space.

User stack 210 has a dynamic size that is continuously scalable in size, and kernel stack 220 has a fixed size stack.

The stack area is configured to allocate a certain size (two pages, that is, 8KB) when the kernel stack is created.

A page is a unit of data storage in a computer system using virtual memory that can be moved from auxiliary storage to real storage at once when data is requested that is not in real storage, or RAM.

The initial stack pointer points to the first address in the stack area.

The stack pointer points to the current location on the stack. This means that it has an address for this location.

The stack 220a without task information indicates a case in which all 8 KB areas are used only for stack purposes. The task information is located in a separate memory space.

The stack 220b with task information is a case where the task information and the kernel stack area use the same memory space. Preferably, the size of the task information is usually 1 KB or less.

In the conventional method, when a push or pop operation occurs during kernel execution, the stack pointer allocated to the stack area may be exceeded (8KB), and in this case, the kernel may invade another memory area. Will crash.

If the stack usage exceeds 8 KB in the stack 220a without task information, a problem is caused by touching an adjacent memory area. In this case, however, it may not be a problem if an adjacent memory area is not used, invading.

When the task information and the kernel stack area use the same memory space in the stack 220b including the task information, when the kernel stack exceeds 7 KB, the task information is broken and thus a 100% problem occurs. Task information is important because it should not be broken, which puts you in a more dangerous situation.

As such, in the conventional kernel system, the kernel stack overflow is not separately processed by the OS having the fixed size stack. Because of this, when a stack overflow occurs, the memory area allocated to the stack is moved out of the way, thereby invading other memory areas. This affects other behaviors of the kernel, which then cause the kernel to behave strangely or cause kernel panic. As a result, it causes a big problem in securing the stability of the operating system, and the development period greatly increases.

The present invention provides a page fault when a stack pointer enters a protected area by adding a protected area to the last part of a stack area allocated to a fixed size due to an apparatus and method for dynamically detecting kernel mode stack overflow in a computer operating system. Its purpose is to handle kernel stack overflow detection by triggering.

Another object of the present invention is to provide a method for debugging overflow of a stack having a fixed size pre-allocated in kernel mode.

The objects of the present invention are not limited to the above-mentioned objects, and other objects that are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, a dynamic detection device for kernel mode stack overflow in a computer operating system according to an embodiment of the present invention is a kernel stack manager for initializing the stack by adding a protection area to the rear of the stack area when the kernel stack is generated. If a page fault exception occurs when an overflow occurs in the kernel stack, a page fault handler that outputs an error message, a virtual memory manager responsible for addressing the memory used in the kernel and a kernel stack, and a predetermined page for the memory. And a page frame allocator that maps to the virtual memory when the memory is allocated and managed in units of data.

In order to achieve the above object, a dynamic detection method for kernel mode stack overflow in a computer operating system according to an embodiment of the present invention comprises the steps of creating and initializing a kernel stack region in a virtual address space in a kernel stack manager, a device driver, and a file system. Operating the kernel stack while the kernel subsystems of the server are running, generating a page fault exception when an overflow occurs because a stack pointer enters a protected area of the kernel stack, and

Dealing with the overflow.

Specific details of other embodiments are included in the detailed description and the drawings.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

Hereinafter, the present invention will be described with reference to a block diagram or a flowchart illustrating a dynamic detection apparatus and method for kernel mode stack overflow in a computer operating system according to embodiments of the present invention.

At this point, it will be understood that each block of the flowchart illustrations and combinations of flowchart illustrations may be performed by computer program instructions.

Since these computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment, those instructions executed through the processor of the computer or other programmable data processing equipment may be described in flow chart block (s). It creates a means to perform the functions.

These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in the flowchart block (s).

Computer program instructions It is also possible to mount on a computer or other programmable data processing equipment, so that a series of operating steps are performed on the computer or other programmable data processing equipment to create a computer-implemented process to perform the computer or other programmable data processing equipment. It is also possible for the instructions to provide steps for performing the functions described in the flowchart block (s).

In addition, each block may represent a portion, segment, or portion of code that includes one or more executable instructions for executing a specified logical function (s).

It should also be noted that in some alternative implementations, the functions noted in the blocks may occur out of order.

For example, the two blocks shown in succession may in fact be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending on the corresponding function.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

3 is a diagram illustrating components for memory management of a kernel system in a computer operating system according to an exemplary embodiment of the present invention.

As shown, components for memory management of a kernel system in a computer operating system according to an embodiment of the present invention are the kernel stack manager 310, page fault handler 320, virtual memory manager 330, page frame allocator (Page Frame Allogator) 340, and other elements 350 are included.

The kernel stack manager 310 initializes the stack by adding a protection area at the rear of the stack area when generating the kernel stack.

The page fault handler 320 generates a page fault exception when a kernel stack overflow occurs, and performs a process when an overflow occurs such as an error message output in the page fault handler.

The virtual memory manager 330 is a virtual memory manager of the kernel and is responsible for addressing memory used in the kernel and addressing the kernel stack. The virtual address space managed by the kernel's virtual memory manager is not associated with physical memory when the memory is first allocated, and a page fault exception occurs when the physical memory is not associated with access to the virtual address space. Generated and mapped to physical memory by the Page Fault Handler.

The page frame allocator 340 manages the physical memory in units of 4 KB pages, and allocates the physical memory to the virtual memory if necessary. The physical memory used by the kernel stack is allocated here.

The other element 350 refers to subsystems of the kernel constituting the kernel, such as a device driver and a file system. As the kernel code is executed, push and pop operations occur in the kernel stack area as the kernel code is executed, and an overflow occurs when a push larger than the allocated stack size occurs. .

Among the above kernel subsystems, the kernel stack manager 310 and the page fault handler 320 are different from those of the conventional kernel. It is involved in the operation of kernel stack creation and initialization and overflow processing in the present invention.

4 illustrates an operation of a kernel system in a computer operating system according to an exemplary embodiment of the present invention.

As shown, the kernel stack manager represents creating and initializing a kernel stack region in the virtual address space.

As in the prior art, the kernel uses a virtual address space, and the virtual address space is largely divided into a kernel region and a user region (not shown).

The stack 410a without task information indicates a case in which all 8 KB areas are used only for stack purposes. The task information is located in a separate memory space. Add a protected area with no physical pages allocated between the task information and the stack area. If the stack usage exceeds 8KB in the stack 410a without task information, the problem that may be caused by touching adjacent memory areas is prevented.

The stack 410b including the task information is a case where the task information and the kernel stack area use the same memory space.

Task information for managing tasks in the kernel is allocated to 8KB for each task, and a stack pointer is set at the highest address of this 8KB allocated for task information maintenance to maintain kernel stack information for each task.

In the stack 410b including the task information, a protection region in which a physical page is not allocated is added between the task information and the stack region. In this case, a total of four pages (16KB) are allocated. When the kernel stack exceeds 8KB (overflows occur), a page fault occurs in the protected area, which keeps the task information safe.

5 is a flowchart of a memory management method of a kernel system in a computer operating system according to an exemplary embodiment of the present invention.

The kernel stack manager creates and initializes a kernel stack region in the virtual address space (S510).

The protection region is added to the end of the stack region (S520). A total of three pages (12KB) are allocated as a stack area by allocating one page as a protection area. At this time, the protection area is initialized without allocating a physical page.

The kernel stack operates while kernel subsystems such as a device driver and a file system are performed (S530).

When the stack pointer is in the stack area, it operates in the same manner as the conventional method.

When the stack pointer enters the protection area (an overflow occurs), a page fault exception occurs because the protection area is not mapped to a physical page (S540).

Process the overflow (S550).

If a kernel stack overflow occurs, the page fault handler will print an error message. The messages include stack pointers, call traces, and overflowed task information to help identify the cause of the problem when an error occurs.

The term '~ part' used in an embodiment of the present invention means a software component or a hardware component such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC), and '~ part' refers to predetermined roles. Perform.

However, '~' is not meant to be limited to software or hardware.

'~ Portion' may be configured to be in an addressable storage medium or may be configured to play one or more processors.

Thus, as an example, '~' means components such as software components, object-oriented software components, class components, and task components, and processes, functions, properties, procedures, and the like. Subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays, and variables.

The functionality provided within the components and the 'parts' may be combined into a smaller number of components and the 'parts' or further separated into additional components and the 'parts'.

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. You will understand that. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive.

According to the apparatus and method for dynamically detecting kernel mode stack overflow in a computer operating system of the present invention as described above, one or more of the following effects are provided.

It can be useful when debugging because it can identify the location of the kernel code that caused the overflow when a kernel stack overflow occurs.

This has the advantage of providing kernel stability.

Claims (4)

A kernel stack manager that initializes the stack by adding a protection area at the end of the stack area when the kernel stack is created; A page fault handler that outputs an error message when a page fault exception occurs when an overflow occurs in the kernel stack; A virtual memory manager responsible for addressing a memory used in the kernel and addressing a kernel stack; And And a page frame allocator for managing the memory in predetermined page units and mapping the memory to the virtual memory when allocating the memory. The method of claim 1, And a protection area of the stack area is included in the stack area in units of one page, and initializes the kernel mode stack overflow in an unallocated state. Creating and initializing a kernel stack region in a virtual address space in the kernel stack manager; Operating the kernel stack while a device driver and a kernel subsystem of a file system are executed; Generating a page fault exception when an overflow occurs because a stack pointer enters a protected area of the kernel stack; And And a method for dynamically detecting a kernel mode stack overflow in a computer operating system including processing the overflow. The method of claim 3, wherein The overflow processing step may include outputting an error message in a page fault handler, including a stack pointer, a call trace, and information on the overflowed task to determine a cause of a problem when an error occurs. Dynamic Detection of Kernel-Mode Stack Overflows.

Images