REDZONE(9)

✨ REDZONE — it's giving buffer corruption detector ✨

okay bestie, buckle up, we're doing the REDZONE(9) page from the Kernel Developer's Manual 🎀 this one's a whole vibe and also genuinely iconic.

---

💖 NAME 💖

RedZone — the buffer corruptions detector. yes that's the whole name. short, sweet, catches your bugs. periodt.

---

🌸 SYNOPSIS 🌸

options KDB
options DDB
options DEBUG_REDZONE

that's it. that's the whole setup. three little options lines and you're in business ✨

---

🦋 DESCRIPTION 🦋

okay so RedZone is out here catching buffer underflow and buffer overflow bugs at runtime. like, while everything is running. no cap.

Currently, RedZone only detects buffer corruptions for memory allocated with malloc(9). that's the scope, bestie, don't come for her about anything else 💅

When such corruption is detected, two backtraces get printed on the console. and the way that works is so satisfying:

1. The first one shows from where memory was allocated.
2. The second one shows from where memory was freed.

so you get the receipts on both ends. chef's kiss 😭

By default the system will not panic when buffer corruption is detected. it just tells you about it, very chill, very demure. This can be changed by setting the vm.redzone.panic sysctl(8) variable to 1. so if you want the dramatic exit, that's your girl 🔥

The amount of extra memory allocated for RedZone's needs is stored in the vm.redzone.extra_mem sysctl(8) variable. she's got a budget and it's tracked, we love transparency 🫶

---

🔥 EXAMPLE 🔥

here's the moment you've all been waiting for. The example below shows the logs from the detection of a buffer underflow and a buffer overflow. no edits, no filter, exactly what you'd see:

REDZONE: Buffer underflow detected. 2 bytes corrupted before 0xc8688580 (16 bytes allocated).
Allocation backtrace:
#0 0xc0583e4e at redzone_setup+0x3c
#1 0xc04a23fa at malloc+0x19e
#2 0xcdeb69ca at redzone_modevent+0x60
#3 0xc04a3f3c at module_register_init+0x82
#4 0xc049d96a at linker_file_sysinit+0x8e
#5 0xc049dc7c at linker_load_file+0xed
#6 0xc04a041f at linker_load_module+0xc4
#7 0xc049e883 at kldload+0x116
#8 0xc05d9b3d at syscall+0x325
#9 0xc05c944f at Xint0x80_syscall+0x1f
Free backtrace:
#0 0xc0583f92 at redzone_check+0xd4
#1 0xc04a2422 at free+0x1c
#2 0xcdeb69a6 at redzone_modevent+0x3c
#3 0xc04a438d at module_unload+0x61
#4 0xc049e0b3 at linker_file_unload+0x89
#5 0xc049e979 at kern_kldunload+0x96
#6 0xc049ea00 at kldunloadf+0x2c
#7 0xc05d9b3d at syscall+0x325
#8 0xc05c944f at Xint0x80_syscall+0x1f

REDZONE: Buffer overflow detected. 4 bytes corrupted after 0xc8688590 (16 bytes allocated).
Allocation backtrace:
#0 0xc0583e4e at redzone_setup+0x3c
#1 0xc04a23fa at malloc+0x19e
#2 0xcdeb69ca at redzone_modevent+0x60
#3 0xc04a3f3c at module_register_init+0x82
#4 0xc049d96a at linker_file_sysinit+0x8e
#5 0xc049dc7c at linker_load_file+0xed
#6 0xc04a041f at linker_load_module+0xc4
#7 0xc049e883 at kldload+0x116
#8 0xc05d9b3d at syscall+0x325
#9 0xc05c944f at Xint0x80_syscall+0x1f
Free backtrace:
#0 0xc0584020 at redzone_check+0x162
#1 0xc04a2422 at free+0x1c
#2 0xcdeb69a6 at redzone_modevent+0x3c
#3 0xc04a438d at module_unload+0x61
#4 0xc049e0b3 at linker_file_unload+0x89
#5 0xc049e979 at kern_kldunload+0x96
#6 0xc049ea00 at kldunloadf+0x2c
#7 0xc05d9b3d at syscall+0x325
#8 0xc05c944f at Xint0x80_syscall+0x1f

look at those backtraces. allocated here, freed there, 2 bytes before, 4 bytes after. it's giving forensic scientist 🧚

---

💜 SEE ALSO 💜

• sysctl(8)
• malloc(9)
• memguard(9)

go read them, bestie, they're the supporting cast and they ate 💅

---

⭐ HISTORY ⭐

RedZone first appeared in FreeBSD 7.0. an icon, a legend, a moment in time 🎀

---

👑 AUTHORS 👑

Pawel Jakub Dawidek <pjd@FreeBSD.org>

main character energy fr fr 🫶

---

💀 BUGS 💀

Currently, RedZone does not cooperate with memguard(9). ngl, they're not on speaking terms 😭

Allocations from a memory type controlled by memguard(9) are simply skipped, so buffer corruptions will not be detected there.

lowkey important: if you're expecting memguard(9) territory to be covered, it isn't. skipped means skipped. no detection happening over there, bestie 🙈

---

okay that's the whole page! written up by the Debian crew and dated January 9, 2009, from the REDZONE(9) manual. tysm for reading, go catch some buffer corruptions, ily, bye ✨💖🌈