Question

If I mprotect a segment with PROT_NONE and if a SIGSEGV occurs due to a write which gets handled by sigaction with sa_sigaction, We will be able to find the address where the fault occurs using siginfo_t‘s si_addr. But is there a way to find the data and the length of the data that was tried to be written ?

I am trying to do this because I trying a copy-on-write mechanism for my project.

Answer 1

You can’t find the data the process tried to write, nor does it make sense to ask about its size. If you could get the data it would mean the kernel had already copied it somewhere.

You get a SIGSEGV on an entire page. That is, regardless of the data the process is writing, you will get exactly one fault per page – the first time you try to write a byte. So all you need to do is:

• Keep track of page state
• Increase permissions as needed