From e91117fa8ed2d00ae520454d6fecfce8abae0664 Mon Sep 17 00:00:00 2001 From: Alexander Leidinger Date: Wed, 29 Jan 2025 09:32:00 +0100 Subject: [PATCH] Improve the stack clash protection description. Despite not being mentioned in the docs of gcc and clang, the stack clash protection is architecture / implementation dependent. Reported by: jrtc27 --- share/man/man7/mitigations.7 | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/share/man/man7/mitigations.7 b/share/man/man7/mitigations.7 index 4db6589cdcf..c3c6ab55c48 100644 --- a/share/man/man7/mitigations.7 +++ b/share/man/man7/mitigations.7 @@ -28,7 +28,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd January 25, 2025 +.Dd January 29, 2025 .Dt MITIGATIONS 7 .Os .Sh NAME @@ -244,8 +244,9 @@ and it is possible that some applications may not function correctly. .Fx supports stack overflow protection using the Stack Smashing Protector .Pq SSP -compiler feature, -and stack clash protection. +compiler feature. +Stack clash protection is also enabled, +if supported by the compiler for the given architecture. In userland, SSP adds a per-process randomized canary at the end of every stack frame which is checked for corruption upon return from the function, and stack probing in