Dealing with Uninitialized Memory in the Kernel
summary
KMSAN, a compiler-instrumentation detector integrated with fuzzing, finds lots of real kernel bugs: KMSAN (compiler-based detector) reports about found ~240 bugs, ~200 real, 119 fixed over two years while covering ~12% of x86 kernel code. Linux 5.3 adds heap and stack init options init_on_alloc and init_on_free to eliminate classes of info leaks and use‑after‑free exploits, with clang/GCC plugin work, mitigation tradeoffs measured (performance, cache lines) and hope for hardware-assisted MTE tagging to make initialization cheap and reliable.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:19Kernel Memory Centers
- 7:08What Shall We Do To Never Have To Deal with an Initialized Memory Again
- 17:21The Increase in Stack Frame Size for Functions
- 19:19Is It Possible To Turn Memory Sanitizer into Runtime Mitigation Not Just Debugging Technique
- 20:54Why some Bugs Are Fixed Earlier than Others
- 22:05Code Coverage
related talks
59mSanitizing the Linux Kernel — On KASAN and other Dynamic Bug-finding Tools
56mKilling Uninitialized Memory: Protecting the OS Without Destroying Performance
18mExploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
42mLinux Kernel Hardening Techniques
50mAddressSanitizer/ThreadSanitizer for Linux Kernel
37mBreaking and Fixing the Kernel: Crashes, Debugging & Performance Tun...
42mUnderstanding Data Races in the Linux Kernel