Exactly right. You mprotect or munmap the end of the altstack,
not the area beyond it.

/Mikael
-

[ message continues ]

So we tell users "Even if you protectted half of mmap's space, but you must to register all space to 
kernel. " ?

The image about my test code's result:
               No patch        Patched
┌───────────┐
│           │← 1 ┌ ← 3          ← 1
│    A      │    │(wraparound)
│           │    │
│           │← 2 │              ← 2
│           │    │
├───────────┤    │
│▒▒▒▒▒▒▒▒▒▒▒│← 3 ┘              ← 3
│▒▒▒▒B▒▒▒▒▒▒│                  (caught)
│▒protected▒│
│▒▒▒▒▒▒▒▒▒▒▒│
│▒▒▒▒▒▒▒▒▒▒▒│
└───────────┘
A+B  mmap's space
A    sigaltstack
B    protectted

I agree that if register A+B to kernel, the wraparound will stop.
But if register A to kernel, why not kernel do something?

Thanks

-

[ message continues ]