std/sys/pal/unix/

stack_overflow.rs

#![cfg_attr(test, allow(dead_code))]
#![forbid(unsafe_op_in_unsafe_fn)]

pub use self::imp::init;
use self::imp::{drop_handler, make_handler};

pub struct Handler {
    data: *mut libc::c_void,
}

impl Handler {
    pub unsafe fn new() -> Handler {
        make_handler(false)
    }

    fn null() -> Handler {
        Handler { data: crate::ptr::null_mut() }
    }
}

impl Drop for Handler {
    fn drop(&mut self) {
        unsafe {
            drop_handler(self.data);
        }
    }
}

#[cfg(all(
    not(miri),
    any(
        target_os = "linux",
        target_os = "freebsd",
        target_os = "hurd",
        target_os = "macos",
        target_os = "netbsd",
        target_os = "openbsd",
        target_os = "solaris",
        target_os = "illumos",
    ),
))]
mod thread_info;

// miri doesn't model signals nor stack overflows and this code has some
// synchronization properties that we don't want to expose to user code,
// hence we disable it on miri.
#[cfg(all(
    not(miri),
    any(
        target_os = "linux",
        target_os = "freebsd",
        target_os = "hurd",
        target_os = "macos",
        target_os = "netbsd",
        target_os = "openbsd",
        target_os = "solaris",
        target_os = "illumos",
    )
))]
mod imp {
    use libc::{
        MAP_ANON, MAP_FAILED, MAP_FIXED, MAP_PRIVATE, PROT_NONE, PROT_READ, PROT_WRITE, SA_ONSTACK,
        SA_SIGINFO, SIG_DFL, SIGBUS, SIGSEGV, SS_DISABLE, sigaction, sigaltstack, sighandler_t,
    };
    #[cfg(not(all(target_os = "linux", target_env = "gnu")))]
    use libc::{mmap as mmap64, mprotect, munmap};
    #[cfg(all(target_os = "linux", target_env = "gnu"))]
    use libc::{mmap64, mprotect, munmap};

    use super::Handler;
    use super::thread_info::{delete_current_info, set_current_info, with_current_info};
    use crate::ops::Range;
    use crate::sync::atomic::{Atomic, AtomicBool, AtomicPtr, AtomicUsize, Ordering};
    use crate::sys::pal::unix::conf;
    use crate::{io, mem, ptr};

    /// Signal handler for the SIGSEGV and SIGBUS handlers.
    ///
    /// We've got guard pages (unmapped pages) at the end of every thread's
    /// stack, so if a thread ends up running into the guard page it'll trigger
    /// this handler. We want to detect these cases and print out a helpful error
    /// saying that the stack has overflowed. All other signals, however, should
    /// go back to what they were originally supposed to do.
    ///
    /// This handler currently exists purely to print an informative message
    /// whenever a thread overflows its stack. We then abort to exit and
    /// indicate a crash, but to avoid a misleading SIGSEGV that might lead
    /// users to believe that unsafe code has accessed an invalid pointer; the
    /// SIGSEGV encountered when overflowing the stack is expected and
    /// well-defined.
    ///
    /// If this is not a stack overflow, the handler un-registers itself and
    /// then returns (to allow the original signal to be delivered again).
    /// Returning from this kind of signal handler is technically not defined
    /// to work when reading the POSIX spec strictly, but in practice it turns
    /// out many large systems and all implementations allow returning from a
    /// signal handler to work. For a more detailed explanation see the
    /// comments on #26458.
    ///
    /// # Safety
    /// Rust doesn't call this, it *gets called* by the kernel, which we expect
    /// to provide valid parameters. Apart from that, this function does not
    /// have any other preconditions.
    unsafe extern "C" fn signal_handler(
        signum: libc::c_int,
        info: *mut libc::siginfo_t,
        _data: *mut libc::c_void,
    ) {
        // SAFETY: this pointer is provided by the system and will always point to a valid `siginfo_t`.
        let fault_addr = unsafe { (*info).si_addr().addr() };

        // `with_current_info` expects that the process aborts after it is
        // called. If the signal was not caused by a memory access, this might
        // not be true. We detect this by noticing that the `si_addr` field is
        // zero if the signal is synthetic.
        if fault_addr != 0 {
            with_current_info(|thread_info| {
                // If the faulting address is within the guard page, then we print a
                // message saying so and abort.
                if let Some(thread_info) = thread_info
                    && thread_info.guard_page_range.contains(&fault_addr)
                {
                    // Hey you! Yes, you modifying the stack overflow message!
                    // Please make sure that all functions called here are
                    // actually async-signal-safe. If they're not, try retrieving
                    // the information beforehand and storing it in `ThreadInfo`.
                    // Thank you!
                    // - says Jonas after having had to watch his carefully
                    //   written code get made unsound again.
                    let tid = thread_info.tid;
                    let name = thread_info.name.as_deref().unwrap_or("<unknown>");
                    rtprintpanic!("\nthread '{name}' ({tid}) has overflowed its stack\n");
                    rtabort!("stack overflow");
                }
            })
        }

        // Unregister ourselves by reverting back to the default behavior.
        // SAFETY: assuming all platforms define struct sigaction as "zero-initializable"
        let mut action: sigaction = unsafe { mem::zeroed() };
        action.sa_sigaction = SIG_DFL;
        // SAFETY: pray this is a well-behaved POSIX implementation of fn sigaction
        unsafe { sigaction(signum, &action, ptr::null_mut()) };

        // See comment above for why this function returns.
    }

    static PAGE_SIZE: Atomic<usize> = AtomicUsize::new(0);
    // Store a pointer to the allocation for the main thread's altstack so that
    // tools like valgrind don't complain about a leaked unreachable allocation.
    //
    // If the main thread exits, the process will terminate so there's no use in
    // freeing resources. It also means that the altstack is still installed
    // while TLS destructors are run on the main thread (c.f. #111272).
    static MAIN_ALTSTACK: Atomic<*mut libc::c_void> = AtomicPtr::new(ptr::null_mut());
    static NEED_ALTSTACK: Atomic<bool> = AtomicBool::new(false);

    /// # Safety
    /// Must be called only once, on the main thread, during program startup.
    pub unsafe fn init() {
        PAGE_SIZE.store(conf::page_size(), Ordering::Relaxed);

        // SAFETY:
        // This is only called on the main thread, and since it is still early
        // in the programs lifetime there is (almost) certainly enough stack
        // space left to install the guard page.
        let mut guard_page_range = unsafe { install_main_guard() };

        // Even for panic=immediate-abort, installing the guard pages is important for soundness.
        // That said, we do not care about giving nice stackoverflow messages via our custom
        // signal handler, just exit early and let the user enjoy the segfault.
        if cfg!(panic = "immediate-abort") {
            return;
        }

        // SAFETY: C structures are always zero-initializable.
        let mut action: sigaction = unsafe { mem::zeroed() };
        for &signal in &[SIGSEGV, SIGBUS] {
            // SAFETY: just fetches the current signal handler into action
            unsafe { sigaction(signal, ptr::null_mut(), &mut action) };
            // We assume that overriding the signal handler is always safe,
            // which might conflict with certain libraries that rely on a
            // specific signal behaviour. To prevent problems, we only
            // override the handler if it has not been set yet.
            if action.sa_sigaction == SIG_DFL {
                if !NEED_ALTSTACK.load(Ordering::Relaxed) {
                    // haven't set up our sigaltstack yet
                    NEED_ALTSTACK.store(true, Ordering::Release);
                    let handler = make_handler(true);
                    MAIN_ALTSTACK.store(handler.data, Ordering::Relaxed);
                    mem::forget(handler);

                    if let Some(guard_page_range) = guard_page_range.take() {
                        set_current_info(guard_page_range);
                    }
                }

                action.sa_flags = SA_SIGINFO | SA_ONSTACK;
                action.sa_sigaction = signal_handler
                    as unsafe extern "C" fn(i32, *mut libc::siginfo_t, *mut libc::c_void)
                    as sighandler_t;
                // SAFETY:
                // `&action` describes a valid `sigaction` and `signal_handler`
                // is safe to use as a signal handler for `SIGSEGV` and `SIGBUS`.
                unsafe { sigaction(signal, &action, ptr::null_mut()) };
            }
        }
    }

    fn get_stack() -> libc::stack_t {
        // OpenBSD requires this flag for stack mapping
        // otherwise the said mapping will fail as a no-op on most systems
        // and has a different meaning on FreeBSD
        #[cfg(any(
            target_os = "openbsd",
            target_os = "netbsd",
            target_os = "linux",
            target_os = "dragonfly",
        ))]
        let flags = MAP_PRIVATE | MAP_ANON | libc::MAP_STACK;
        #[cfg(not(any(
            target_os = "openbsd",
            target_os = "netbsd",
            target_os = "linux",
            target_os = "dragonfly",
        )))]
        let flags = MAP_PRIVATE | MAP_ANON;

        let sigstack_size = sigstack_size();
        let page_size = PAGE_SIZE.load(Ordering::Relaxed);

        // SAFETY: this does not unmap any existing pages.
        let stackp = unsafe {
            mmap64(ptr::null_mut(), sigstack_size + page_size, PROT_READ | PROT_WRITE, flags, -1, 0)
        };
        if stackp == MAP_FAILED {
            panic!("failed to allocate an alternative stack: {}", io::Error::last_os_error());
        }
        // SAFETY: this only affects the memory we just allocated.
        let guard_result = unsafe { libc::mprotect(stackp, page_size, PROT_NONE) };
        if guard_result != 0 {
            panic!("failed to set up alternative stack guard page: {}", io::Error::last_os_error());
        }
        // SAFETY:
        // The region was allocated with a larger size than `page_size`, so this
        // addition is within bounds.
        let stackp = unsafe { stackp.add(page_size) };

        libc::stack_t { ss_sp: stackp, ss_flags: 0, ss_size: sigstack_size }
    }

    pub fn make_handler(main_thread: bool) -> Handler {
        if cfg!(panic = "immediate-abort") || !NEED_ALTSTACK.load(Ordering::Acquire) {
            return Handler::null();
        }

        if !main_thread {
            if let Some(guard_page_range) = current_guard() {
                set_current_info(guard_page_range);
            }
        }

        // Load the current alternate signal stack to see if we need to install
        // our own.
        //
        // SAFETY: C structures are always zero-initializable.
        let mut stack = unsafe { mem::zeroed() };
        // SAFETY: `&mut stack` is valid for writing a `stack_t`.
        unsafe { sigaltstack(ptr::null(), &mut stack) };

        // Configure alternate signal stack, if one is not already set.
        if stack.ss_flags & SS_DISABLE != 0 {
            let stack = get_stack();
            // SAFETY:
            // `stack_t` is a freshly allocated stack that's not used anywhere
            // else. It contains a guard page, so stack overflows in signal
            // handlers will not cause undefined behaviour. We must make the
            // fundamental runtime assumption that it is safe to install an
            // alternate signal stack if there is none currently installed.
            // This might conflict with foreign libraries that use the existence
            // of an alternate signal stack as indication that certain runtime
            // initialisation by the library has been performed (e.g. old
            // versions of `std` assumed that certain thread-locals were already
            // accessed and thus initialized in the thread if the stack overflow
            // signal was successfully delivered). Such assumptions in other
            // libraries are fundamentally flawed, so we pay no regard to them.
            unsafe { sigaltstack(&stack, ptr::null_mut()) };
            Handler { data: stack.ss_sp as *mut libc::c_void }
        } else {
            Handler::null()
        }
    }

    /// # Safety
    /// Must only be called with a pointer returned by `make_handler`, and only
    /// once per `Handler`.
    pub unsafe fn drop_handler(data: *mut libc::c_void) {
        if !data.is_null() {
            let sigstack_size = sigstack_size();
            let page_size = PAGE_SIZE.load(Ordering::Relaxed);
            let disabling_stack = libc::stack_t {
                ss_sp: ptr::null_mut(),
                ss_flags: SS_DISABLE,
                // Workaround for bug in macOS implementation of sigaltstack
                // UNIX2003 which returns ENOMEM when disabling a stack while
                // passing ss_size smaller than MINSIGSTKSZ. According to POSIX
                // both ss_sp and ss_size should be ignored in this case.
                ss_size: sigstack_size,
            };
            // SAFETY:
            // We assume that disabling the alternate signal stack is always
            // sound, even if the current alternate signal stack is not the one
            // we installed in `make_handler`. Any stack overflows from this
            // point on will abort the program when the kernel tries to write
            // the signal information to the guard page.
            //
            // FIXME: detect if the stack has changed, and only uninstall if it hasn't.
            unsafe { sigaltstack(&disabling_stack, ptr::null_mut()) };
            // The stack returned by `get_stack` is part of a mapping that
            // started one page earlier, so walk back a page and unmap from
            // there.
            //
            // SAFETY:
            // This allocation was created by us in `get_stack` and, as the
            // alternate signal stack is now disabled, is no longer in use.
            unsafe { munmap(data.sub(page_size), sigstack_size + page_size) };
        }

        delete_current_info();
    }

    /// Modern kernels on modern hardware can have dynamic signal stack sizes.
    #[cfg(all(any(target_os = "linux", target_os = "android"), not(target_env = "uclibc")))]
    fn sigstack_size() -> usize {
        // SAFETY: `getauxval` is always safe to call.
        let dynamic_sigstksz = unsafe { libc::getauxval(libc::AT_MINSIGSTKSZ) };
        // If getauxval couldn't find the entry, it returns 0,
        // so take the higher of the "constant" and auxval.
        // This transparently supports older kernels which don't provide AT_MINSIGSTKSZ
        libc::SIGSTKSZ.max(dynamic_sigstksz as _)
    }

    /// Not all OS support hardware where this is needed.
    #[cfg(not(all(any(target_os = "linux", target_os = "android"), not(target_env = "uclibc"))))]
    fn sigstack_size() -> usize {
        libc::SIGSTKSZ
    }

    #[cfg(any(target_os = "solaris", target_os = "illumos"))]
    fn get_stack_start() -> Option<*mut libc::c_void> {
        // SAFETY: C types are always zero-initializable.
        let mut current_stack: libc::stack_t = unsafe { crate::mem::zeroed() };
        // SAFETY:
        // The pointer is valid for writing a `stack_t`.
        assert_eq!(unsafe { libc::stack_getbounds(&mut current_stack) }, 0);
        Some(current_stack.ss_sp)
    }

    #[cfg(target_os = "macos")]
    fn get_stack_start() -> Option<*mut libc::c_void> {
        // SAFETY: always safe to call.
        let th = unsafe { libc::pthread_self() };
        // SAFETY: `th` is a valid `pthread_t`.
        unsafe {
            let stackptr = libc::pthread_get_stackaddr_np(th);
            let stacksize = libc::pthread_get_stacksize_np(th);
            Some(stackptr.map_addr(|addr| addr - stacksize))
        }
    }

    #[cfg(target_os = "openbsd")]
    fn get_stack_start() -> Option<*mut libc::c_void> {
        // SAFETY: C types are always zero-initializable.
        let mut current_stack: libc::stack_t = unsafe { crate::mem::zeroed() };
        // SAFETY:
        // * calling `pthread_self` is always valid and returns a valid `pthread_t`.
        // * `&mut current_stack` is coerced to a pointer that is valid for writing
        //   a `stack_t`.
        assert_eq!(
            unsafe { libc::pthread_stackseg_np(libc::pthread_self(), &mut current_stack) },
            0
        );

        let stack_ptr = current_stack.ss_sp;
        // SAFETY: this is always safe to call.
        let stackaddr = if unsafe { libc::pthread_main_np() } == 1 {
            // main thread
            stack_ptr.addr() - current_stack.ss_size + PAGE_SIZE.load(Ordering::Relaxed)
        } else {
            // new thread
            stack_ptr.addr() - current_stack.ss_size
        };
        Some(stack_ptr.with_addr(stackaddr))
    }

    #[cfg(any(
        target_os = "android",
        target_os = "freebsd",
        target_os = "netbsd",
        target_os = "hurd",
        target_os = "linux",
        target_os = "l4re"
    ))]
    fn get_stack_start() -> Option<*mut libc::c_void> {
        use crate::pin::pin;
        use crate::sys::helpers::COpaque;

        let mut ret = None;
        let mut attr: COpaque<libc::pthread_attr_t> = COpaque::uninit();
        if !cfg!(target_os = "freebsd") {
            attr = COpaque::zeroed();
        }
        let attr = pin!(attr);
        // FIXME(pin-ergonomics): remove the next line.
        let attr = attr.into_ref();

        // SAFETY:
        // The attributes object has not been initialized yet and will not be
        // moved until destroyed.
        #[cfg(target_os = "freebsd")]
        assert_eq!(unsafe { libc::pthread_attr_init(attr.get()) }, 0);
        // SAFETY:
        // * calling `pthread_self` is always valid and returns a valid `pthread_t`
        // * `attr` is an initialized attribute object that can be written to.
        #[cfg(target_os = "freebsd")]
        let e = unsafe { libc::pthread_attr_get_np(libc::pthread_self(), attr.get()) };
        // SAFETY:
        // * calling `pthread_self` is always valid and returns a valid `pthread_t`
        // * `attr` can be written to, and will be initialized by this call.
        #[cfg(not(target_os = "freebsd"))]
        let e = unsafe { libc::pthread_getattr_np(libc::pthread_self(), attr.get()) };
        if e == 0 {
            let mut stackaddr = crate::ptr::null_mut();
            let mut stacksize = 0;
            // SAFETY:
            // `attr` is an initialized attribute object and both the pointers
            // are valid for writing.
            assert_eq!(
                unsafe { libc::pthread_attr_getstack(attr.get(), &mut stackaddr, &mut stacksize) },
                0
            );
            ret = Some(stackaddr);
        }
        if e == 0 || cfg!(target_os = "freebsd") {
            // SAFETY:
            // `attr` was initialized either by `pthread_attr_init` (FreeBSD) or
            // by `pthread_attr_get_np`, and is not used after this point.
            assert_eq!(unsafe { libc::pthread_attr_destroy(attr.get()) }, 0);
        }
        ret
    }

    fn stack_start_aligned(page_size: usize) -> Option<*mut libc::c_void> {
        let stackptr = get_stack_start()?;
        let stackaddr = stackptr.addr();

        // Ensure stackaddr is page aligned! A parent process might
        // have reset RLIMIT_STACK to be non-page aligned. The
        // pthread_attr_getstack() reports the usable stack area
        // stackaddr < stackaddr + stacksize, so if stackaddr is not
        // page-aligned, calculate the fix such that stackaddr <
        // new_page_aligned_stackaddr < stackaddr + stacksize
        let remainder = stackaddr % page_size;
        Some(if remainder == 0 {
            stackptr
        } else {
            stackptr.with_addr(stackaddr + page_size - remainder)
        })
    }

    /// # Safety
    /// This function must only be called from the main thread, and there must
    /// be sufficient stack space remaining to place a stack guard.
    unsafe fn install_main_guard() -> Option<Range<usize>> {
        let page_size = PAGE_SIZE.load(Ordering::Relaxed);

        // this way someone on any unix-y OS can check that all these compile
        if cfg!(all(target_os = "linux", not(target_env = "musl"))) {
            install_main_guard_linux(page_size)
        } else if cfg!(all(target_os = "linux", target_env = "musl")) {
            install_main_guard_linux_musl(page_size)
        } else if cfg!(target_os = "freebsd") {
            #[cfg(not(target_os = "freebsd"))]
            return None;
            // The FreeBSD code cannot be checked on non-BSDs.
            #[cfg(target_os = "freebsd")]
            install_main_guard_freebsd(page_size)
        } else if cfg!(any(target_os = "netbsd", target_os = "openbsd")) {
            install_main_guard_bsds(page_size)
        } else {
            // SAFETY: guaranteed by caller.
            unsafe { install_main_guard_default(page_size) }
        }
    }

    fn install_main_guard_linux(page_size: usize) -> Option<Range<usize>> {
        // See the corresponding conditional in init().
        // Avoid stack_start_aligned, which makes slow syscalls to read /proc/self/maps
        if cfg!(panic = "immediate-abort") {
            return None;
        }
        // Linux doesn't allocate the whole stack right away, and
        // the kernel has its own stack-guard mechanism to fault
        // when growing too close to an existing mapping. If we map
        // our own guard, then the kernel starts enforcing a rather
        // large gap above that, rendering much of the possible
        // stack space useless. See #43052.
        //
        // Instead, we'll just note where we expect rlimit to start
        // faulting, so our handler can report "stack overflow", and
        // trust that the kernel's own stack guard will work.
        let stackptr = stack_start_aligned(page_size)?;
        let stackaddr = stackptr.addr();
        Some(stackaddr - page_size..stackaddr)
    }

    fn install_main_guard_linux_musl(_page_size: usize) -> Option<Range<usize>> {
        // For the main thread, the musl's pthread_attr_getstack
        // returns the current stack size, rather than maximum size
        // it can eventually grow to. It cannot be used to determine
        // the position of kernel's stack guard.
        None
    }

    #[cfg(target_os = "freebsd")]
    fn install_main_guard_freebsd(page_size: usize) -> Option<Range<usize>> {
        // See the corresponding conditional in install_main_guard_linux().
        if cfg!(panic = "immediate-abort") {
            return None;
        }
        // FreeBSD's stack autogrows, and optionally includes a guard page
        // at the bottom. If we try to remap the bottom of the stack
        // ourselves, FreeBSD's guard page moves upwards. So we'll just use
        // the builtin guard page.
        let stackptr = stack_start_aligned(page_size)?;
        let guardaddr = stackptr.addr();
        // Technically the number of guard pages is tunable and controlled
        // by the security.bsd.stack_guard_page sysctl.
        // By default it is 1, checking once is enough since it is
        // a boot time config value.
        // FIXME(joboet): this function is only called once, remove the caching.
        static PAGES: crate::sync::OnceLock<usize> = crate::sync::OnceLock::new();

        let pages = PAGES.get_or_init(|| {
            let mut guard: usize = 0;
            let mut size = size_of_val(&guard);
            let oid = c"security.bsd.stack_guard_page";

            let r = unsafe {
                libc::sysctlbyname(
                    oid.as_ptr(),
                    (&raw mut guard).cast(),
                    &raw mut size,
                    ptr::null_mut(),
                    0,
                )
            };
            if r == 0 { guard } else { 1 }
        });
        Some(guardaddr..guardaddr + pages * page_size)
    }

    fn install_main_guard_bsds(page_size: usize) -> Option<Range<usize>> {
        // See the corresponding conditional in install_main_guard_linux().
        if cfg!(panic = "immediate-abort") {
            return None;
        }
        // OpenBSD stack already includes a guard page, and stack is
        // immutable.
        // NetBSD stack includes the guard page.
        //
        // We'll just note where we expect rlimit to start
        // faulting, so our handler can report "stack overflow", and
        // trust that the kernel's own stack guard will work.
        let stackptr = stack_start_aligned(page_size)?;
        let stackaddr = stackptr.addr();
        Some(stackaddr - page_size..stackaddr)
    }

    /// # Safety
    /// This function must only be called from the main thread, and there must
    /// be sufficient stack space remaining to place a stack guard.
    unsafe fn install_main_guard_default(page_size: usize) -> Option<Range<usize>> {
        // Reallocate the last page of the stack.
        // This ensures SIGBUS will be raised on
        // stack overflow.
        // Systems which enforce strict PAX MPROTECT do not allow
        // to mprotect() a mapping with less restrictive permissions
        // than the initial mmap() used, so we mmap() here with
        // read/write permissions and only then mprotect() it to
        // no permissions at all. See issue #50313.
        let stackptr = stack_start_aligned(page_size)?;
        // SAFETY:
        // The memory region from `stackptr..stackptr + page_size` belongs to
        // the current thread's stack, and the caller has asserted that there
        // is sufficient stack space, which means that this will not overwrite
        // any existing allocations.
        let result = unsafe {
            mmap64(
                stackptr,
                page_size,
                PROT_READ | PROT_WRITE,
                MAP_PRIVATE | MAP_ANON | MAP_FIXED,
                -1,
                0,
            )
        };
        if result != stackptr || result == MAP_FAILED {
            panic!("failed to allocate a guard page: {}", io::Error::last_os_error());
        }

        // SAFETY:
        // Since this function is only called on the main thread, the stack will
        // not be reused until program exit, so the runtime will never observe
        // that part of the stack has been made unusable in this way.
        let result = unsafe { mprotect(stackptr, page_size, PROT_NONE) };
        if result != 0 {
            panic!("failed to protect the guard page: {}", io::Error::last_os_error());
        }

        let guardaddr = stackptr.addr();

        Some(guardaddr..guardaddr + page_size)
    }

    #[cfg(any(
        target_os = "macos",
        target_os = "openbsd",
        target_os = "solaris",
        target_os = "illumos",
    ))]
    fn current_guard() -> Option<Range<usize>> {
        let stackptr = get_stack_start()?;
        let stackaddr = stackptr.addr();
        Some(stackaddr - PAGE_SIZE.load(Ordering::Relaxed)..stackaddr)
    }

    #[cfg(any(
        target_os = "android",
        target_os = "freebsd",
        target_os = "hurd",
        target_os = "linux",
        target_os = "netbsd",
        target_os = "l4re"
    ))]
    fn current_guard() -> Option<Range<usize>> {
        use crate::pin::pin;
        use crate::sys::helpers::COpaque;

        let mut ret = None;

        let mut attr: COpaque<libc::pthread_attr_t> = COpaque::uninit();
        if !cfg!(target_os = "freebsd") {
            attr = COpaque::zeroed();
        }
        let attr = pin!(attr);
        // FIXME(pin-ergonomics): remove the next line.
        let attr = attr.into_ref();

        // SAFETY:
        // The attributes object has not been initialized yet and will not be
        // moved until destroyed.
        #[cfg(target_os = "freebsd")]
        assert_eq!(unsafe { libc::pthread_attr_init(attr.get()) }, 0);
        // SAFETY:
        // * calling `pthread_self` is always valid and returns a valid `pthread_t`
        // * `attr` is an initialized attribute object that can be written to.
        #[cfg(target_os = "freebsd")]
        let e = unsafe { libc::pthread_attr_get_np(libc::pthread_self(), attr.get()) };
        // SAFETY:
        // * calling `pthread_self` is always valid and returns a valid `pthread_t`
        // * `attr` can be written to, and will be initialized by this call.
        #[cfg(not(target_os = "freebsd"))]
        let e = unsafe { libc::pthread_getattr_np(libc::pthread_self(), attr.get()) };
        if e == 0 {
            let mut guardsize = 0;
            // SAFETY:
            // `attr` is an initialized attribute object and the pointer is valid
            // for writing.
            assert_eq!(unsafe { libc::pthread_attr_getguardsize(attr.get(), &mut guardsize) }, 0);
            if guardsize == 0 {
                if cfg!(all(target_os = "linux", target_env = "musl")) {
                    // musl versions before 1.1.19 always reported guard
                    // size obtained from pthread_attr_get_np as zero.
                    // Use page size as a fallback.
                    guardsize = PAGE_SIZE.load(Ordering::Relaxed);
                } else {
                    panic!("there is no guard page");
                }
            }
            let mut stackptr = crate::ptr::null_mut::<libc::c_void>();
            let mut size = 0;
            // SAFETY:
            // `attr` is an initialized attribute object and both the pointers
            // are valid for writing.
            assert_eq!(
                unsafe { libc::pthread_attr_getstack(attr.get(), &mut stackptr, &mut size) },
                0
            );

            let stackaddr = stackptr.addr();
            ret = if cfg!(any(target_os = "freebsd", target_os = "netbsd", target_os = "hurd")) {
                Some(stackaddr - guardsize..stackaddr)
            } else if cfg!(all(target_os = "linux", target_env = "musl")) {
                Some(stackaddr - guardsize..stackaddr)
            } else if cfg!(all(target_os = "linux", any(target_env = "gnu", target_env = "uclibc")))
            {
                // glibc used to include the guard area within the stack, as noted in the BUGS
                // section of `man pthread_attr_getguardsize`. This has been corrected starting
                // with glibc 2.27, and in some distro backports, so the guard is now placed at the
                // end (below) the stack. There's no easy way for us to know which we have at
                // runtime, so we'll just match any fault in the range right above or below the
                // stack base to call that fault a stack overflow.
                Some(stackaddr - guardsize..stackaddr + guardsize)
            } else {
                Some(stackaddr..stackaddr + guardsize)
            };
        }
        if e == 0 || cfg!(target_os = "freebsd") {
            // SAFETY:
            // `attr` was initialized either by `pthread_attr_init` (FreeBSD) or
            // by `pthread_attr_get_np`, and is not used after this point.
            assert_eq!(unsafe { libc::pthread_attr_destroy(attr.get()) }, 0);
        }
        ret
    }
}

// This is intentionally not enabled on iOS/tvOS/watchOS/visionOS, as it uses
// several symbols that might lead to rejections from the App Store, namely
// `sigaction`, `sigaltstack`, `sysctlbyname`, `mmap`, `munmap` and `mprotect`.
//
// This might be overly cautious, though it is also what Swift does (and they
// usually have fewer qualms about forwards compatibility, since the runtime
// is shipped with the OS):
// <https://github.com/apple/swift/blob/swift-5.10-RELEASE/stdlib/public/runtime/CrashHandlerMacOS.cpp>
#[cfg(any(
    miri,
    not(any(
        target_os = "linux",
        target_os = "freebsd",
        target_os = "hurd",
        target_os = "macos",
        target_os = "netbsd",
        target_os = "openbsd",
        target_os = "solaris",
        target_os = "illumos",
        target_os = "cygwin",
    ))
))]
mod imp {
    pub unsafe fn init() {}

    pub fn make_handler(_main_thread: bool) -> super::Handler {
        super::Handler::null()
    }

    pub unsafe fn drop_handler(_data: *mut libc::c_void) {}
}

#[cfg(target_os = "cygwin")]
mod imp {
    mod c {
        pub type PVECTORED_EXCEPTION_HANDLER =
            Option<unsafe extern "system" fn(exceptioninfo: *mut EXCEPTION_POINTERS) -> i32>;
        pub type NTSTATUS = i32;
        pub type BOOL = i32;

        unsafe extern "system" {
            pub fn AddVectoredExceptionHandler(
                first: u32,
                handler: PVECTORED_EXCEPTION_HANDLER,
            ) -> *mut core::ffi::c_void;
            pub fn SetThreadStackGuarantee(stacksizeinbytes: *mut u32) -> BOOL;
        }

        pub const EXCEPTION_STACK_OVERFLOW: NTSTATUS = 0xC00000FD_u32 as _;
        pub const EXCEPTION_CONTINUE_SEARCH: i32 = 1i32;

        #[repr(C)]
        #[derive(Clone, Copy)]
        pub struct EXCEPTION_POINTERS {
            pub ExceptionRecord: *mut EXCEPTION_RECORD,
            // We don't need this field here
            // pub Context: *mut CONTEXT,
        }
        #[repr(C)]
        #[derive(Clone, Copy)]
        pub struct EXCEPTION_RECORD {
            pub ExceptionCode: NTSTATUS,
            pub ExceptionFlags: u32,
            pub ExceptionRecord: *mut EXCEPTION_RECORD,
            pub ExceptionAddress: *mut core::ffi::c_void,
            pub NumberParameters: u32,
            pub ExceptionInformation: [usize; 15],
        }
    }

    /// Reserve stack space for use in stack overflow exceptions.
    fn reserve_stack() {
        let result = unsafe { c::SetThreadStackGuarantee(&mut 0x5000) };
        // Reserving stack space is not critical so we allow it to fail in the released build of libstd.
        // We still use debug assert here so that CI will test that we haven't made a mistake calling the function.
        debug_assert_ne!(result, 0, "failed to reserve stack space for exception handling");
    }

    unsafe extern "system" fn vectored_handler(ExceptionInfo: *mut c::EXCEPTION_POINTERS) -> i32 {
        // SAFETY: It's up to the caller (which in this case is the OS) to ensure that `ExceptionInfo` is valid.
        unsafe {
            let rec = &(*(*ExceptionInfo).ExceptionRecord);
            let code = rec.ExceptionCode;

            if code == c::EXCEPTION_STACK_OVERFLOW {
                crate::thread::with_current_name(|name| {
                    let name = name.unwrap_or("<unknown>");
                    let tid = crate::thread::current_os_id();
                    rtprintpanic!("\nthread '{name}' ({tid}) has overflowed its stack\n");
                });
            }
            c::EXCEPTION_CONTINUE_SEARCH
        }
    }

    pub unsafe fn init() {
        // SAFETY: `vectored_handler` has the correct ABI and is safe to call during exception handling.
        unsafe {
            let result = c::AddVectoredExceptionHandler(0, Some(vectored_handler));
            // Similar to the above, adding the stack overflow handler is allowed to fail
            // but a debug assert is used so CI will still test that it normally works.
            debug_assert!(!result.is_null(), "failed to install exception handler");
        }
        // Set the thread stack guarantee for the main thread.
        reserve_stack();
    }

    pub fn make_handler(main_thread: bool) -> super::Handler {
        if !main_thread {
            reserve_stack();
        }
        super::Handler::null()
    }

    pub unsafe fn drop_handler(_data: *mut libc::c_void) {}
}