ASLR for thread stacks

[Jan Schaumann <jschauma%netmeister.org@localhost>]

Hi,

I was looking at how ASLR applies to pthreads.  It
looks to me as if on NetBSD, ASLR will give me an
unpredictable stack location for 'main' as well as for
the first thread created, but that subsequent threads
get a stack located at "previous thread stack address
- stack size - guardpage size".

So for example, if my stack size (via
getrlimit(RLIMIT_STACK))) is 8M, and my guard page
size (via pthread_attr_getguardsize(3)) is 64K, and my
initial thread is found at 0xFFEDB4BFFBD0 then the
next thread created will be predictably placed at

0xFFEDB4BFFBD0 - 0x800000 - 0x10000 = 0xFFEDB43EFBD0

On OpenBSD and FreeBSD, each thread appears to get a
stack at an unpredictable location, while macOS and
Linux appear to also set the threads at a predictable
offset (573440 bytes for macOS, stacksize + guardpage
for Linux).

Wouldn't it be desirable and perhaps expected to have
ASLR place thread stacks at unpredictable locations?

-Jan