REDZONE(9)

💅 REDZONE(9) — like, the buffer corruption detector bestie

okay so you're reading the Kernel Developer's Manual page for RedZone, and honestly? she's that girl. let's get into it 🫶

---

✨ NAME ✨

RedZone — buffer corruptions detector 🔍

---

✨ SYNOPSIS ✨

options KDB
options DDB
options DEBUG_REDZONE

that's it, that's the whole vibe check to turn her on 💫

---

✨ DESCRIPTION ✨

okay so RedZone's whole thing is catching buffer underflow and buffer overflow bugs at runtime. at runtime!! like she's watching live, not doing some boring post-mortem 😤

rn she's a little limited ngl — she only detects buffer corruptions for memory that was allocated with malloc(9). so like, that's her lane, and she slays in it.

when she does catch corruption, she prints two backtraces on the console:

• the first one shows from where the memory was allocated 🌱
• the second one shows from where the memory was freed 🍂

by default the system will not panic when buffer corruption is detected — she's dramatic but she's not gonna crash your whole box uninvited 💀. you can change that by setting the vm.redzone.panic sysctl(8) variable to 1.

and the amount of extra memory allocated for RedZone's needs? that lives in the vm.redzone.extra_mem sysctl(8) variable. she's greedy but she tells you about it 🎀

---

✨ EXAMPLE ✨

here's the actual logs from catching a buffer underflow and a buffer overflow. iconic detective work fr fr 🔥

      REDZONE: Buffer underflow detected. 2 bytes corrupted before 0xc8688580 (16 bytes allocated).
      Allocation backtrace:
      #0 0xc0583e4e at redzone_setup+0x3c
      #1 0xc04a23fa at malloc+0x19e
      #2 0xcdeb69ca at redzone_modevent+0x60
      #3 0xc04a3f3c at module_register_init+0x82
      #4 0xc049d96a at linker_file_sysinit+0x8e
      #5 0xc049dc7c at linker_load_file+0xed
      #6 0xc04a041f at linker_load_module+0xc4
      #7 0xc049e883 at kldload+0x116
      #8 0xc05d9b3d at syscall+0x325
      #9 0xc05c944f at Xint0x80_syscall+0x1f
      Free backtrace:
      #0 0xc0583f92 at redzone_check+0xd4
      #1 0xc04a2422 at free+0x1c
      #2 0xcdeb69a6 at redzone_modevent+0x3c
      #3 0xc04a438d at module_unload+0x61
      #4 0xc049e0b3 at linker_file_unload+0x89
      #5 0xc049e979 at kern_kldunload+0x96
      #6 0xc049ea00 at kldunloadf+0x2c
      #7 0xc05d9b3d at syscall+0x325
      #8 0xc05c944f at Xint0x80_syscall+0x1f

      REDZONE: Buffer overflow detected. 4 bytes corrupted after 0xc8688590 (16 bytes allocated).
      Allocation backtrace:
      #0 0xc0583e4e at redzone_setup+0x3c
      #1 0xc04a23fa at malloc+0x19e
      #2 0xcdeb69ca at redzone_modevent+0x60
      #3 0xc04a3f3c at module_register_init+0x82
      #4 0xc049d96a at linker_file_sysinit+0x8e
      #5 0xc049dc7c at linker_load_file+0xed
      #6 0xc04a041f at linker_load_module+0xc4
      #7 0xc049e883 at kldload+0x116
      #8 0xc05d9b3d at syscall+0x325
      #9 0xc05c944f at Xint0x80_syscall+0x1f
      Free backtrace:
      #0 0xc0584020 at redzone_check+0x162
      #1 0xc04a2422 at free+0x1c
      #2 0xcdeb69a6 at redzone_modevent+0x3c
      #3 0xc04a438d at module_unload+0x61
      #4 0xc049e0b3 at linker_file_unload+0x89
      #5 0xc049e979 at kern_kldunload+0x96
      #6 0xc049ea00 at kldunloadf+0x2c
      #7 0xc05d9b3d at syscall+0x325
      #8 0xc05c944f at Xint0x80_syscall+0x1f

look at all those frames. she really said "here's the receipts, both of them" 😭👑

---

✨ SEE ALSO ✨

• sysctl(8)
• malloc(9)
• memguard(9)

go read those too, they're part of the friend group 🌸

---

✨ HISTORY ✨

RedZone first appeared in FreeBSD 7.0. a legend was born ✨

---

✨ AUTHORS ✨

Pawel Jakub Dawidek <pjd@FreeBSD.org> — thank you king 👑🫶

---

✨ BUGS ✨

okay so here's the tea: currently, RedZone does not cooperate with memguard(9). allocations from a memory type controlled by memguard(9) are simply skipped, so buffer corruptions will not be detected there 🙈

not her fault, but you should know. fr fr. 💀

---

and that's the page!! brought to you by Debian, January 9, 2009 🎀 — yeah she's been around a minute, but she still ate 💅⭐