std/sys/pal/unix/stack_overflow/

handler_signal.rs

use libc::{
    MAP_ANON, MAP_FAILED, MAP_FIXED, MAP_PRIVATE, PROT_NONE, PROT_READ, PROT_WRITE, SA_ONSTACK,
    SA_SIGINFO, SIG_DFL, SIGBUS, SIGSEGV, SS_DISABLE, sigaction, sigaltstack, sighandler_t,
};
#[cfg(not(all(target_os = "linux", target_env = "gnu")))]
use libc::{mmap as mmap64, mprotect, munmap};
#[cfg(all(target_os = "linux", target_env = "gnu"))]
use libc::{mmap64, mprotect, munmap};

use super::Handler;
use super::thread_info::{delete_current_info, set_current_info, with_current_info};
use crate::ops::Range;
use crate::sync::atomic::{Atomic, AtomicBool, AtomicPtr, AtomicUsize, Ordering};
use crate::sys::pal::unix::conf;
use crate::{io, mem, ptr};

/// Signal handler for the SIGSEGV and SIGBUS handlers.
///
/// We've got guard pages (unmapped pages) at the end of every thread's
/// stack, so if a thread ends up running into the guard page it'll trigger
/// this handler. We want to detect these cases and print out a helpful error
/// saying that the stack has overflowed. All other signals, however, should
/// go back to what they were originally supposed to do.
///
/// This handler currently exists purely to print an informative message
/// whenever a thread overflows its stack. We then abort to exit and
/// indicate a crash, but to avoid a misleading SIGSEGV that might lead
/// users to believe that unsafe code has accessed an invalid pointer; the
/// SIGSEGV encountered when overflowing the stack is expected and
/// well-defined.
///
/// If this is not a stack overflow, the handler un-registers itself and
/// then returns (to allow the original signal to be delivered again).
/// Returning from this kind of signal handler is technically not defined
/// to work when reading the POSIX spec strictly, but in practice it turns
/// out many large systems and all implementations allow returning from a
/// signal handler to work. For a more detailed explanation see the
/// comments on #26458.
///
/// # Safety
/// Rust doesn't call this, it *gets called* by the kernel, which we expect
/// to provide valid parameters. Apart from that, this function does not
/// have any other preconditions.
unsafe extern "C" fn signal_handler(
    signum: libc::c_int,
    info: *mut libc::siginfo_t,
    _data: *mut libc::c_void,
) {
    // SAFETY: this pointer is provided by the system and will always point to a valid `siginfo_t`.
    let fault_addr = unsafe { (*info).si_addr().addr() };

    // `with_current_info` expects that the process aborts after it is
    // called. If the signal was not caused by a memory access, this might
    // not be true. We detect this by noticing that the `si_addr` field is
    // zero if the signal is synthetic.
    if fault_addr != 0 {
        with_current_info(|thread_info| {
            // If the faulting address is within the guard page, then we print a
            // message saying so and abort.
            if let Some(thread_info) = thread_info
                && thread_info.guard_page_range.contains(&fault_addr)
            {
                // Hey you! Yes, you modifying the stack overflow message!
                // Please make sure that all functions called here are
                // actually async-signal-safe. If they're not, try retrieving
                // the information beforehand and storing it in `ThreadInfo`.
                // Thank you!
                // - says Jonas after having had to watch his carefully
                //   written code get made unsound again.
                let tid = thread_info.tid;
                let name = thread_info.name.as_deref().unwrap_or("<unknown>");
                rtprintpanic!("\nthread '{name}' ({tid}) has overflowed its stack\n");
                rtabort!("stack overflow");
            }
        })
    }

    // Unregister ourselves by reverting back to the default behavior.
    // SAFETY: assuming all platforms define struct sigaction as "zero-initializable"
    let mut action: sigaction = unsafe { mem::zeroed() };
    action.sa_sigaction = SIG_DFL;
    // SAFETY: pray this is a well-behaved POSIX implementation of fn sigaction
    unsafe { sigaction(signum, &action, ptr::null_mut()) };

    // See comment above for why this function returns.
}

static PAGE_SIZE: Atomic<usize> = AtomicUsize::new(0);
// Store a pointer to the allocation for the main thread's altstack so that
// tools like valgrind don't complain about a leaked unreachable allocation.
//
// If the main thread exits, the process will terminate so there's no use in
// freeing resources. It also means that the altstack is still installed
// while TLS destructors are run on the main thread (c.f. #111272).
static MAIN_ALTSTACK: Atomic<*mut libc::c_void> = AtomicPtr::new(ptr::null_mut());
static NEED_ALTSTACK: Atomic<bool> = AtomicBool::new(false);

/// # Safety
/// Must be called only once, on the main thread, during program startup.
pub unsafe fn init() {
    PAGE_SIZE.store(conf::page_size(), Ordering::Relaxed);

    // SAFETY:
    // This is only called on the main thread, and since it is still early
    // in the programs lifetime there is (almost) certainly enough stack
    // space left to install the guard page.
    let mut guard_page_range = unsafe { install_main_guard() };

    // Even for panic=immediate-abort, installing the guard pages is important for soundness.
    // That said, we do not care about giving nice stackoverflow messages via our custom
    // signal handler, just exit early and let the user enjoy the segfault.
    if cfg!(panic = "immediate-abort") {
        return;
    }

    // SAFETY: C structures are always zero-initializable.
    let mut action: sigaction = unsafe { mem::zeroed() };
    for &signal in &[SIGSEGV, SIGBUS] {
        // SAFETY: just fetches the current signal handler into action
        unsafe { sigaction(signal, ptr::null_mut(), &mut action) };
        // We assume that overriding the signal handler is always safe,
        // which might conflict with certain libraries that rely on a
        // specific signal behaviour. To prevent problems, we only
        // override the handler if it has not been set yet.
        if action.sa_sigaction == SIG_DFL {
            if !NEED_ALTSTACK.load(Ordering::Relaxed) {
                // haven't set up our sigaltstack yet
                NEED_ALTSTACK.store(true, Ordering::Release);
                let handler = make_handler(true);
                MAIN_ALTSTACK.store(handler.data, Ordering::Relaxed);
                mem::forget(handler);

                if let Some(guard_page_range) = guard_page_range.take() {
                    set_current_info(guard_page_range);
                }
            }

            action.sa_flags = SA_SIGINFO | SA_ONSTACK;
            action.sa_sigaction = signal_handler
                as unsafe extern "C" fn(i32, *mut libc::siginfo_t, *mut libc::c_void)
                as sighandler_t;
            // SAFETY:
            // `&action` describes a valid `sigaction` and `signal_handler`
            // is safe to use as a signal handler for `SIGSEGV` and `SIGBUS`.
            unsafe { sigaction(signal, &action, ptr::null_mut()) };
        }
    }
}

fn get_stack() -> libc::stack_t {
    // OpenBSD requires this flag for stack mapping
    // otherwise the said mapping will fail as a no-op on most systems
    // and has a different meaning on FreeBSD
    #[cfg(any(
        target_os = "openbsd",
        target_os = "netbsd",
        target_os = "linux",
        target_os = "dragonfly",
    ))]
    let flags = MAP_PRIVATE | MAP_ANON | libc::MAP_STACK;
    #[cfg(not(any(
        target_os = "openbsd",
        target_os = "netbsd",
        target_os = "linux",
        target_os = "dragonfly",
    )))]
    let flags = MAP_PRIVATE | MAP_ANON;

    let sigstack_size = sigstack_size();
    let page_size = PAGE_SIZE.load(Ordering::Relaxed);

    // SAFETY: this does not unmap any existing pages.
    let stackp = unsafe {
        mmap64(ptr::null_mut(), sigstack_size + page_size, PROT_READ | PROT_WRITE, flags, -1, 0)
    };
    if stackp == MAP_FAILED {
        panic!("failed to allocate an alternative stack: {}", io::Error::last_os_error());
    }
    // SAFETY: this only affects the memory we just allocated.
    let guard_result = unsafe { libc::mprotect(stackp, page_size, PROT_NONE) };
    if guard_result != 0 {
        panic!("failed to set up alternative stack guard page: {}", io::Error::last_os_error());
    }
    // SAFETY:
    // The region was allocated with a larger size than `page_size`, so this
    // addition is within bounds.
    let stackp = unsafe { stackp.add(page_size) };

    libc::stack_t { ss_sp: stackp, ss_flags: 0, ss_size: sigstack_size }
}

pub fn make_handler(main_thread: bool) -> Handler {
    if cfg!(panic = "immediate-abort") || !NEED_ALTSTACK.load(Ordering::Acquire) {
        return Handler::null();
    }

    if !main_thread {
        if let Some(guard_page_range) = current_guard() {
            set_current_info(guard_page_range);
        }
    }

    // Load the current alternate signal stack to see if we need to install
    // our own.
    //
    // SAFETY: C structures are always zero-initializable.
    let mut stack = unsafe { mem::zeroed() };
    // SAFETY: `&mut stack` is valid for writing a `stack_t`.
    unsafe { sigaltstack(ptr::null(), &mut stack) };

    // Configure alternate signal stack, if one is not already set.
    if stack.ss_flags & SS_DISABLE != 0 {
        let stack = get_stack();
        // SAFETY:
        // `stack_t` is a freshly allocated stack that's not used anywhere
        // else. It contains a guard page, so stack overflows in signal
        // handlers will not cause undefined behaviour. We must make the
        // fundamental runtime assumption that it is safe to install an
        // alternate signal stack if there is none currently installed.
        // This might conflict with foreign libraries that use the existence
        // of an alternate signal stack as indication that certain runtime
        // initialisation by the library has been performed (e.g. old
        // versions of `std` assumed that certain thread-locals were already
        // accessed and thus initialized in the thread if the stack overflow
        // signal was successfully delivered). Such assumptions in other
        // libraries are fundamentally flawed, so we pay no regard to them.
        unsafe { sigaltstack(&stack, ptr::null_mut()) };
        Handler { data: stack.ss_sp as *mut libc::c_void }
    } else {
        Handler::null()
    }
}

/// # Safety
/// Must only be called with a pointer returned by `make_handler`, and only
/// once per `Handler`.
pub unsafe fn drop_handler(data: *mut libc::c_void) {
    if !data.is_null() {
        let sigstack_size = sigstack_size();
        let page_size = PAGE_SIZE.load(Ordering::Relaxed);
        let disabling_stack = libc::stack_t {
            ss_sp: ptr::null_mut(),
            ss_flags: SS_DISABLE,
            // Workaround for bug in macOS implementation of sigaltstack
            // UNIX2003 which returns ENOMEM when disabling a stack while
            // passing ss_size smaller than MINSIGSTKSZ. According to POSIX
            // both ss_sp and ss_size should be ignored in this case.
            ss_size: sigstack_size,
        };
        // SAFETY:
        // We assume that disabling the alternate signal stack is always
        // sound, even if the current alternate signal stack is not the one
        // we installed in `make_handler`. Any stack overflows from this
        // point on will abort the program when the kernel tries to write
        // the signal information to the guard page.
        //
        // FIXME: detect if the stack has changed, and only uninstall if it hasn't.
        unsafe { sigaltstack(&disabling_stack, ptr::null_mut()) };
        // The stack returned by `get_stack` is part of a mapping that
        // started one page earlier, so walk back a page and unmap from
        // there.
        //
        // SAFETY:
        // This allocation was created by us in `get_stack` and, as the
        // alternate signal stack is now disabled, is no longer in use.
        unsafe { munmap(data.sub(page_size), sigstack_size + page_size) };
    }

    delete_current_info();
}

/// Modern kernels on modern hardware can have dynamic signal stack sizes.
#[cfg(all(any(target_os = "linux", target_os = "android"), not(target_env = "uclibc")))]
fn sigstack_size() -> usize {
    // SAFETY: `getauxval` is always safe to call.
    let dynamic_sigstksz = unsafe { libc::getauxval(libc::AT_MINSIGSTKSZ) };
    // If getauxval couldn't find the entry, it returns 0,
    // so take the higher of the "constant" and auxval.
    // This transparently supports older kernels which don't provide AT_MINSIGSTKSZ
    libc::SIGSTKSZ.max(dynamic_sigstksz as _)
}

/// Not all OS support hardware where this is needed.
#[cfg(not(all(any(target_os = "linux", target_os = "android"), not(target_env = "uclibc"))))]
fn sigstack_size() -> usize {
    libc::SIGSTKSZ
}

#[cfg(any(target_os = "solaris", target_os = "illumos"))]
fn get_stack_start() -> Option<*mut libc::c_void> {
    // SAFETY: C types are always zero-initializable.
    let mut current_stack: libc::stack_t = unsafe { crate::mem::zeroed() };
    // SAFETY:
    // The pointer is valid for writing a `stack_t`.
    assert_eq!(unsafe { libc::stack_getbounds(&mut current_stack) }, 0);
    Some(current_stack.ss_sp)
}

#[cfg(target_os = "macos")]
fn get_stack_start() -> Option<*mut libc::c_void> {
    // SAFETY: always safe to call.
    let th = unsafe { libc::pthread_self() };
    // SAFETY: `th` is a valid `pthread_t`.
    unsafe {
        let stackptr = libc::pthread_get_stackaddr_np(th);
        let stacksize = libc::pthread_get_stacksize_np(th);
        Some(stackptr.map_addr(|addr| addr - stacksize))
    }
}

#[cfg(target_os = "openbsd")]
fn get_stack_start() -> Option<*mut libc::c_void> {
    // SAFETY: C types are always zero-initializable.
    let mut current_stack: libc::stack_t = unsafe { crate::mem::zeroed() };
    // SAFETY:
    // * calling `pthread_self` is always valid and returns a valid `pthread_t`.
    // * `&mut current_stack` is coerced to a pointer that is valid for writing
    //   a `stack_t`.
    assert_eq!(unsafe { libc::pthread_stackseg_np(libc::pthread_self(), &mut current_stack) }, 0);

    let stack_ptr = current_stack.ss_sp;
    // SAFETY: this is always safe to call.
    let stackaddr = if unsafe { libc::pthread_main_np() } == 1 {
        // main thread
        stack_ptr.addr() - current_stack.ss_size + PAGE_SIZE.load(Ordering::Relaxed)
    } else {
        // new thread
        stack_ptr.addr() - current_stack.ss_size
    };
    Some(stack_ptr.with_addr(stackaddr))
}

#[cfg(any(
    target_os = "android",
    target_os = "freebsd",
    target_os = "netbsd",
    target_os = "hurd",
    target_os = "linux",
    target_os = "l4re"
))]
fn get_stack_start() -> Option<*mut libc::c_void> {
    use crate::pin::pin;
    use crate::sys::helpers::COpaque;

    let mut ret = None;
    let mut attr: COpaque<libc::pthread_attr_t> = COpaque::uninit();
    if !cfg!(target_os = "freebsd") {
        attr = COpaque::zeroed();
    }
    let attr = pin!(attr);
    // FIXME(pin-ergonomics): remove the next line.
    let attr = attr.into_ref();

    // SAFETY:
    // The attributes object has not been initialized yet and will not be
    // moved until destroyed.
    #[cfg(target_os = "freebsd")]
    assert_eq!(unsafe { libc::pthread_attr_init(attr.get()) }, 0);
    // SAFETY:
    // * calling `pthread_self` is always valid and returns a valid `pthread_t`
    // * `attr` is an initialized attribute object that can be written to.
    #[cfg(target_os = "freebsd")]
    let e = unsafe { libc::pthread_attr_get_np(libc::pthread_self(), attr.get()) };
    // SAFETY:
    // * calling `pthread_self` is always valid and returns a valid `pthread_t`
    // * `attr` can be written to, and will be initialized by this call.
    #[cfg(not(target_os = "freebsd"))]
    let e = unsafe { libc::pthread_getattr_np(libc::pthread_self(), attr.get()) };
    if e == 0 {
        let mut stackaddr = crate::ptr::null_mut();
        let mut stacksize = 0;
        // SAFETY:
        // `attr` is an initialized attribute object and both the pointers
        // are valid for writing.
        assert_eq!(
            unsafe { libc::pthread_attr_getstack(attr.get(), &mut stackaddr, &mut stacksize) },
            0
        );
        ret = Some(stackaddr);
    }
    if e == 0 || cfg!(target_os = "freebsd") {
        // SAFETY:
        // `attr` was initialized either by `pthread_attr_init` (FreeBSD) or
        // by `pthread_attr_get_np`, and is not used after this point.
        assert_eq!(unsafe { libc::pthread_attr_destroy(attr.get()) }, 0);
    }
    ret
}

fn stack_start_aligned(page_size: usize) -> Option<*mut libc::c_void> {
    let stackptr = get_stack_start()?;
    let stackaddr = stackptr.addr();

    // Ensure stackaddr is page aligned! A parent process might
    // have reset RLIMIT_STACK to be non-page aligned. The
    // pthread_attr_getstack() reports the usable stack area
    // stackaddr < stackaddr + stacksize, so if stackaddr is not
    // page-aligned, calculate the fix such that stackaddr <
    // new_page_aligned_stackaddr < stackaddr + stacksize
    let remainder = stackaddr % page_size;
    Some(if remainder == 0 {
        stackptr
    } else {
        stackptr.with_addr(stackaddr + page_size - remainder)
    })
}

/// # Safety
/// This function must only be called from the main thread, and there must
/// be sufficient stack space remaining to place a stack guard.
unsafe fn install_main_guard() -> Option<Range<usize>> {
    let page_size = PAGE_SIZE.load(Ordering::Relaxed);

    // this way someone on any unix-y OS can check that all these compile
    if cfg!(all(target_os = "linux", not(target_env = "musl"))) {
        install_main_guard_linux(page_size)
    } else if cfg!(all(target_os = "linux", target_env = "musl")) {
        install_main_guard_linux_musl(page_size)
    } else if cfg!(target_os = "freebsd") {
        #[cfg(not(target_os = "freebsd"))]
        return None;
        // The FreeBSD code cannot be checked on non-BSDs.
        #[cfg(target_os = "freebsd")]
        install_main_guard_freebsd(page_size)
    } else if cfg!(any(target_os = "netbsd", target_os = "openbsd")) {
        install_main_guard_bsds(page_size)
    } else {
        // SAFETY: guaranteed by caller.
        unsafe { install_main_guard_default(page_size) }
    }
}

fn install_main_guard_linux(page_size: usize) -> Option<Range<usize>> {
    // See the corresponding conditional in init().
    // Avoid stack_start_aligned, which makes slow syscalls to read /proc/self/maps
    if cfg!(panic = "immediate-abort") {
        return None;
    }
    // Linux doesn't allocate the whole stack right away, and
    // the kernel has its own stack-guard mechanism to fault
    // when growing too close to an existing mapping. If we map
    // our own guard, then the kernel starts enforcing a rather
    // large gap above that, rendering much of the possible
    // stack space useless. See #43052.
    //
    // Instead, we'll just note where we expect rlimit to start
    // faulting, so our handler can report "stack overflow", and
    // trust that the kernel's own stack guard will work.
    let stackptr = stack_start_aligned(page_size)?;
    let stackaddr = stackptr.addr();
    Some(stackaddr - page_size..stackaddr)
}

fn install_main_guard_linux_musl(_page_size: usize) -> Option<Range<usize>> {
    // For the main thread, the musl's pthread_attr_getstack
    // returns the current stack size, rather than maximum size
    // it can eventually grow to. It cannot be used to determine
    // the position of kernel's stack guard.
    None
}

#[cfg(target_os = "freebsd")]
fn install_main_guard_freebsd(page_size: usize) -> Option<Range<usize>> {
    // See the corresponding conditional in install_main_guard_linux().
    if cfg!(panic = "immediate-abort") {
        return None;
    }
    // FreeBSD's stack autogrows, and optionally includes a guard page
    // at the bottom. If we try to remap the bottom of the stack
    // ourselves, FreeBSD's guard page moves upwards. So we'll just use
    // the builtin guard page.
    let stackptr = stack_start_aligned(page_size)?;
    let guardaddr = stackptr.addr();
    // Technically the number of guard pages is tunable and controlled
    // by the security.bsd.stack_guard_page sysctl.
    // By default it is 1, checking once is enough since it is
    // a boot time config value.
    // FIXME(joboet): this function is only called once, remove the caching.
    static PAGES: crate::sync::OnceLock<usize> = crate::sync::OnceLock::new();

    let pages = PAGES.get_or_init(|| {
        let mut guard: usize = 0;
        let mut size = size_of_val(&guard);
        let oid = c"security.bsd.stack_guard_page";

        let r = unsafe {
            libc::sysctlbyname(
                oid.as_ptr(),
                (&raw mut guard).cast(),
                &raw mut size,
                ptr::null_mut(),
                0,
            )
        };
        if r == 0 { guard } else { 1 }
    });
    Some(guardaddr..guardaddr + pages * page_size)
}

fn install_main_guard_bsds(page_size: usize) -> Option<Range<usize>> {
    // See the corresponding conditional in install_main_guard_linux().
    if cfg!(panic = "immediate-abort") {
        return None;
    }
    // OpenBSD stack already includes a guard page, and stack is
    // immutable.
    // NetBSD stack includes the guard page.
    //
    // We'll just note where we expect rlimit to start
    // faulting, so our handler can report "stack overflow", and
    // trust that the kernel's own stack guard will work.
    let stackptr = stack_start_aligned(page_size)?;
    let stackaddr = stackptr.addr();
    Some(stackaddr - page_size..stackaddr)
}

/// # Safety
/// This function must only be called from the main thread, and there must
/// be sufficient stack space remaining to place a stack guard.
unsafe fn install_main_guard_default(page_size: usize) -> Option<Range<usize>> {
    // Reallocate the last page of the stack.
    // This ensures SIGBUS will be raised on
    // stack overflow.
    // Systems which enforce strict PAX MPROTECT do not allow
    // to mprotect() a mapping with less restrictive permissions
    // than the initial mmap() used, so we mmap() here with
    // read/write permissions and only then mprotect() it to
    // no permissions at all. See issue #50313.
    let stackptr = stack_start_aligned(page_size)?;
    // SAFETY:
    // The memory region from `stackptr..stackptr + page_size` belongs to
    // the current thread's stack, and the caller has asserted that there
    // is sufficient stack space, which means that this will not overwrite
    // any existing allocations.
    let result = unsafe {
        mmap64(
            stackptr,
            page_size,
            PROT_READ | PROT_WRITE,
            MAP_PRIVATE | MAP_ANON | MAP_FIXED,
            -1,
            0,
        )
    };
    if result != stackptr || result == MAP_FAILED {
        panic!("failed to allocate a guard page: {}", io::Error::last_os_error());
    }

    // SAFETY:
    // Since this function is only called on the main thread, the stack will
    // not be reused until program exit, so the runtime will never observe
    // that part of the stack has been made unusable in this way.
    let result = unsafe { mprotect(stackptr, page_size, PROT_NONE) };
    if result != 0 {
        panic!("failed to protect the guard page: {}", io::Error::last_os_error());
    }

    let guardaddr = stackptr.addr();

    Some(guardaddr..guardaddr + page_size)
}

#[cfg(any(
    target_os = "macos",
    target_os = "openbsd",
    target_os = "solaris",
    target_os = "illumos",
))]
fn current_guard() -> Option<Range<usize>> {
    let stackptr = get_stack_start()?;
    let stackaddr = stackptr.addr();
    Some(stackaddr - PAGE_SIZE.load(Ordering::Relaxed)..stackaddr)
}

#[cfg(any(
    target_os = "android",
    target_os = "freebsd",
    target_os = "hurd",
    target_os = "linux",
    target_os = "netbsd",
    target_os = "l4re"
))]
fn current_guard() -> Option<Range<usize>> {
    use crate::pin::pin;
    use crate::sys::helpers::COpaque;

    let mut ret = None;

    let mut attr: COpaque<libc::pthread_attr_t> = COpaque::uninit();
    if !cfg!(target_os = "freebsd") {
        attr = COpaque::zeroed();
    }
    let attr = pin!(attr);
    // FIXME(pin-ergonomics): remove the next line.
    let attr = attr.into_ref();

    // SAFETY:
    // The attributes object has not been initialized yet and will not be
    // moved until destroyed.
    #[cfg(target_os = "freebsd")]
    assert_eq!(unsafe { libc::pthread_attr_init(attr.get()) }, 0);
    // SAFETY:
    // * calling `pthread_self` is always valid and returns a valid `pthread_t`
    // * `attr` is an initialized attribute object that can be written to.
    #[cfg(target_os = "freebsd")]
    let e = unsafe { libc::pthread_attr_get_np(libc::pthread_self(), attr.get()) };
    // SAFETY:
    // * calling `pthread_self` is always valid and returns a valid `pthread_t`
    // * `attr` can be written to, and will be initialized by this call.
    #[cfg(not(target_os = "freebsd"))]
    let e = unsafe { libc::pthread_getattr_np(libc::pthread_self(), attr.get()) };
    if e == 0 {
        let mut guardsize = 0;
        // SAFETY:
        // `attr` is an initialized attribute object and the pointer is valid
        // for writing.
        assert_eq!(unsafe { libc::pthread_attr_getguardsize(attr.get(), &mut guardsize) }, 0);
        if guardsize == 0 {
            if cfg!(all(target_os = "linux", target_env = "musl")) {
                // musl versions before 1.1.19 always reported guard
                // size obtained from pthread_attr_get_np as zero.
                // Use page size as a fallback.
                guardsize = PAGE_SIZE.load(Ordering::Relaxed);
            } else {
                panic!("there is no guard page");
            }
        }
        let mut stackptr = crate::ptr::null_mut::<libc::c_void>();
        let mut size = 0;
        // SAFETY:
        // `attr` is an initialized attribute object and both the pointers
        // are valid for writing.
        assert_eq!(unsafe { libc::pthread_attr_getstack(attr.get(), &mut stackptr, &mut size) }, 0);

        let stackaddr = stackptr.addr();
        ret = if cfg!(any(target_os = "freebsd", target_os = "netbsd", target_os = "hurd")) {
            Some(stackaddr - guardsize..stackaddr)
        } else if cfg!(all(target_os = "linux", target_env = "musl")) {
            Some(stackaddr - guardsize..stackaddr)
        } else if cfg!(all(target_os = "linux", any(target_env = "gnu", target_env = "uclibc"))) {
            // glibc used to include the guard area within the stack, as noted in the BUGS
            // section of `man pthread_attr_getguardsize`. This has been corrected starting
            // with glibc 2.27, and in some distro backports, so the guard is now placed at the
            // end (below) the stack. There's no easy way for us to know which we have at
            // runtime, so we'll just match any fault in the range right above or below the
            // stack base to call that fault a stack overflow.
            Some(stackaddr - guardsize..stackaddr + guardsize)
        } else {
            Some(stackaddr..stackaddr + guardsize)
        };
    }
    if e == 0 || cfg!(target_os = "freebsd") {
        // SAFETY:
        // `attr` was initialized either by `pthread_attr_init` (FreeBSD) or
        // by `pthread_attr_get_np`, and is not used after this point.
        assert_eq!(unsafe { libc::pthread_attr_destroy(attr.get()) }, 0);
    }
    ret
}