Detecting Double Free With BPF
summary
A BPF-based detector hooks malloc/free via BPF+uprobes, stores allocation records in BPF maps, and runs the trace logic in a separate process to keep the target’s memory footprint unchanged and overhead low. It reports stack backtraces when the per-address counter underflows (actual double free detected), succeeds on a Valgrind-bypass example and a C++ smart‑pointer case, outperforms ASan/Valgrind on overhead, and cannot detect races where allocator reuses the same address (detects actual double frees only).
AI-written summary · about
chapters (10)
- 0:00BPF double free detection intro
- 2:58Why double free bugs are critical issues
- 5:55Existing tool limitations
- 8:23BPF and uprobes basics
- 10:18Solution architecture
- 13:15Tool performance Heisenberg
- 16:22Q&A thread safety scope
- 19:05Live demo bypassing GDC C++
- 22:05BPF vs Address Sanitizer
- 27:07Future work conclusion
related talks
27mHotBPF - An On-demand and On-the-fly Memory Protection for the Linux Ker...
43mHotBPF++: A More Powerful Memory Protection for the Linux Kernel
36mThe journey of BPF from restricted C language towards extended and safe C.
41mDetect C++ Memory Leaks with ALSan: Attachable Leak Sanitizer
36mDebugging with eBPF on Arm Platforms
27mWhere have all the kprobes gone
57mBPF and Security. Friends and Foes
20mEPF: Evil Packet Filter