~/talk

Sanitizing the Linux Kernel — On KASAN and other Dynamic Bug-finding Tools

on YouTube 59m
Talkat Linux Security Summit Europe 2022 · 2022-09-15..09-16· [security, linux-and-operating-systems]

speaker

name:Andrey Konovalov
links:none on file

resources

video:https://youtu.be/KmFVPyHyfqQ
slides:none on file

summary

Generic KASAN uses compiler instrumentation plus a kernel runtime with shadow memory (x86 maps 16 TiB) and per-allocator red zones to catch out‑of‑bounds and use‑after‑free in slab, page_alloc, vmalloc, stack and global memory; it adds a quarantine = 1/32 RAM to improve UAF detection and stores allocation/free stack traces in Stack Depot. Expect 2x–3x slowdown (outline mode trades speed for image size). Related tools: KMSAN (uninitialized), KCSAN (races), UBSAN; kfence sampling and software/hardware memory tagging aim for in‑field use.

AI-written summary · about

chapters (27)

  1. 0:00Start
  2. 4:01KASAN-Kernel Address Sanitizer
  3. 5:11KASAN parts
  4. 7:49Shadow byte values for inaccessible memory
  5. 8:13Shadow memory region
  6. 9:02Shadow mapping routines for x86-64
  7. 10:10Compiler instrumentation: 8-byte access
  8. 11:57Slab layout (for SLUB)
  9. 14:28Quarantine for freed memory
  10. 15:46Compiler instrumentation: stack variables [3/3]
  11. 16:39Compiler instrumentation: global variables
  12. 17:17Reporting bugs
  13. 18:56Report example: slab out-of-bounds [5/5]
  14. 22:04Generic KASAN notes and parts
  15. 25:09Generic KASAN summary
  16. 26:55KMSAN - Kernel Memory Sanitizer
  17. 28:08KCSAN - Kernel Concurrency Sanitizer
  18. 29:32UBSAN - [Kernel] Undefined Behavior Sanitizer
  19. 32:21Software Tag-Based KASAN
  20. 36:17Production stack traces for KASAN
  21. 39:50Extending Sanitizers
  22. 40:25Extending KASAN: custom redzones
  23. 42:12Percpu allocator: fairly used
  24. 43:10Percpu allocator: need KASAN annotations
  25. 43:59Extending KMSAN: USB annotations
  26. 44:54Finding more bugs
  27. 46:23Make better bug detectors

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.