Hi, I'm looking on the Linux IA-32 memory model processes see and have a simple question to it. What is there in the grey areas in the picture? Or is it just to show start and end of the memory? So, do text start at 0x0 and stack start at 0xFFFFFFFF?
Best regards, Lasse Espeholt
I think the grey areas simply represent regions of undefined size. Program text certainly wouldn't start at 0x0, because most OSes use them as invalid pages so null dereferences can be caught easily. Thread stacks also wouldn't go right up to 0xffffffff because usually the top quarter (or half) has kernel memory mapped into it.
Note that the zero-page area at the bottom of the address space is not actually forbidden to application use under common linux distributions. The kernel used to do this, then ended up farming that decision out to the LSM module (e.g. SELinux, AppArmor). And they didn't enforce the same rule, so it turned out to be possible for processes to map memory at 0x0. This was part of the vulnerability behind the recent "kernel null pointer dereference" exploits.
Also note that due to address space layout randomization, the starting addresses of some of the sections are randomly offset from the values in the diagrams.
