In the Linux kernel, stack_canary is the one of the stack protection mechanisms.

This value is generated by boot_init_stack_canary(). (/init/main.c)

boot_init_stack_canary() randomly generates stack_canary from get_random_bytes().

And this canary value is referenced into task structure(struct task) and save in the gs segment register.

When a process is generated, the process gets stack_canary from gs segment.

If stack_canary is not refreshed anymore, all processes have the same stack_canary value?

Otherwise, are there any different generation methods?


The stack canary is initialised with a random value any time a task struct is duplicated; see dup_task_struct() in kernel/fork.c (and in particular line 380 in version 4.7). So each forked process gets a random canary, which means there's a very high probability that each process has a different canary (and more importantly, you can't predict another process's stack canary).

boot_init_stack_canary() ensures that the first "task" (the kernel) has a stack canary. That canary isn't re-used for processes.

  • Linux kernel is very difficult and wide for me :( But I checked the code and exactly understood it thanks to you. Your reply is really really helpful :D Thanks a lot. – Tylor Yoo Sep 8 '16 at 2:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.