Kernel Sanitizers Office Hours
summary
Overview of what each kernel sanitizer actually finds, how it’s used, and the real tradeoffs: KASAN hardware tag mode uses ARM MTE to cut runtime cost, while KFence runs sampled checks in production (used on Android) with very low overhead; KMSAN detects uses of uninitialized bits but currently requires Clang and heavy instrumentation; KCSAN finds data races but is extremely noisy (console flood and boot failure on some PowerPC systems) so it relies on KCSAN allowlist/ignorelist and debugfs toggles; UBSAN produced ~187 fixes over seven years and ~143 bounds fixes in five years.
AI-written summary · about
chapters (17)
- 0:00Introduction to Kernel Sanitizers
- 1:51Address Sanitizer (KASAN) overview
- 2:35Kernel Electric Fence (KFENCE) explained
- 3:41Kernel Memory Sanitizer (KMSAN) details
- 4:24Kernel Concurrency Sanitizer (KCSAN) basics
- 5:49Undefined Behavior Sanitizer (UBSAN) features
- 9:03Undefined vs unintended behavior distinction
- 10:10Integer overflow sanitizer challenges
- 13:24Manual annotations for sanitizers
- 17:21KCSAN noise and configuration
- 20:33BPF and KCSAN compatibility
- 21:36Future sanitizer improvements
- 25:41Sanitizer instrumentation issues
- 28:53Compiler choice for sanitizers
- 30:38Tracking folio leaks and refcounts
- 32:25Inducing latency for race testing
- 36:22Virtualization in sanitizer testing
related talks
08mWIP: QKSAN: Towards Multiple Sanitizers for In-vehicle COTS OS Kernels
16mSEMSAN: a Configurable Sanitizer for Detecting System-Level Semantic Bugs
21mFuZZan: Efficient Sanitizer Metadata Design for Fuzzing
26mUndefined Behavior in 2017 (part 2 of 2)
24mWhy you should be using automated fuzzing to test for security issues in your code
01h 00m2020: The Year of Sanitizers?
06mLightning Talk: You Should Use AddressSanitizer
36mCode Analysis: Empowering developers to write performant, reliable, and safe C++