BorrowSanitizer: Securing Rust Across Foreign Function Boundaries
Talkat RustConf 2026 · on Thursday, 2026-09-10· at 11:50· Room 510bd | Palais des Congrès de Montréal, Palais des Congrès de Montréal·
summary
BorrowSanitizer is an LLVM‑based dynamic checker that instruments retag calls emitted by nightly Rust, stores provenance in shadow memory, and validates aliasing across C/C++ FFI; it finds real bugs (Servo and an io_uring wrapper) by reporting “accessed tag is foreign to protected tag.” The tool passes ~92% of ~400 Miri tests, runs on average ~2x faster than Miri, uses stop‑the‑world reference‑counting tree pruning to cut huge tree tails, and trades some Miri precision (e.g. wildcard provenance and integer→pointer modes) for practical cross‑language coverage.
AI-written summary · about
chapters (10)
- 0:00Introduction and motivation
- 3:36Real-world interop bug example
- 7:51Limitations of existing tools
- 9:05How BorrowSanitizer works
- 15:24Retags and provenance tracking
- 18:43Runtime design and shadow memory
- 21:04Tree pruning for performance
- 26:01Current limitations and future work
- 30:08Upstreaming and community impact
- 32:24Q&A session
related talks
17mFoundations for a Rust-Like Borrow Checker for C
22mThe Rust Borrow Checker - A Deep Dive
36mThe Rust Borrow Checker: A Deep Dive
25mMiri: Practical Undefined Behavior Detection for Rust
53mThe Rust Borrow Checker - A Deep Dive
38mThe Rust Borrow Checker: a Deep Dive
50mRust's Borrow Checker Proven Correct!
44mMiri, Undefined Behavior and Foreign Functions