Exciting new compiler flags for kernel security
summary
Describes two concrete toolchain paths: selective sanitization using -lower-allow-check-percentile-cutoff-hot plus -fsanitize-ignorelist that reuses FDO/PGO profiles to instrument UBSAN/bounds only on cold functions, claiming “large coverage for a small portion of the cost”; and clang’s allocation-token plumbing (info_alloc_token / alloc-partition RFC) that computes a type-hash (pointer-split, 16 buckets default) to isolate slab caches. clang22 implements the builtin, kernel RFC proposes typed kmalloc caches, but full protection requires a complementary slab-vto/cross-cache mitigation before deployment.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:03Selective sanitization concept
- 4:56Heap isolation overview
- 7:47Allocation token mechanism
- 11:00Kernel implementation details
- 13:09Slab virtualization need
- 14:13Q&A on selective sanitization
- 16:26Q&A on profiling data
related talks
44mWhere are we on security features?
54mSecurity Features status update
34mMaking C Less Dangerous
01h 05mSecurity in C++: Hardening techniques from the trenches
18mDon't Look UB: Exposing Sanitizer-Eliding Compiler Optimizations
59mBeyond Sanitizers...
01h 34mSecurity in C++ - Hardening Techniques From the Trenches
01h 00mSanitize for your Sanity: Sanitizers tools for Modern C++