Why does setting the unused bits of a virtual address cause a segfault?

54 views Asked by At

On modern x86 platforms CPUs use either 47 or 56 bit virtual addresses theoretically masking out only the individual bit sets needed to resolve indices and offsets for the page walk. However, setting the most significant bits and dereferencing the address leads to a segmentation fault.

I would assume that perhaps the CPU immediately invokes an exception when it sees the non-zero leading bits as they may indicate a corrupted address, but I've heard in a few contexts of developers using these bits as storage for other information as referenced by the Linux kernel docs.

On x86, 5-level paging enables 56-bit userspace virtual address space. Not all user space is ready to handle wide addresses. It’s known that at least some JIT compilers use higher bits in pointers to encode their information. It collides with valid pointers with 5-level paging and leads to crashes.

I would expect this C++ code to work, but it doesn't.

int* x = new int;
std::cout << x << std::endl;
std::cout << *x << std::endl;
x = (int*)((unsigned long)x | (1ul << 63));
std::cout << x << std::endl;
std::cout << *x << std::endl; // This segfaults
0

There are 0 answers