Detecting Borrow and Provenance Bugs Across Unsafe Rust [...]
summary
Claim: a pointer can have a valid address while the access is unsafe, especially across FFI boundaries. Concrete techniques described include shadow memory for byte‑level checks, delaying reuse for temporal safety, and adding metadata for semantic execution to track provenance and permissions. Implementations trade correctness for overhead: semantic tagging gives richer bug reports but slows execution, while selective instrumentation limits cost at the risk of missed bugs. Tools and projects mentioned: tree/stacked borrows, MIR work, Borosanitizer and AddressSanitizer.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:54Pointer passing to C
- 6:19Bite level debugging
- 10:37Temporal safety
- 12:30Semantic validity
- 16:07Selective validity
- 18:41Cross language validity
- 21:14Tool experiences
- 25:36Implementation trade-offs
- 27:48Summary and Q&A
related talks
42mWhat If We Pretended Unsafe Code Was Nice, And Then It Was?
17mFoundations for a Rust-Like Borrow Checker for C
19mCounterexamples in Safe Rust
50mRust's Borrow Checker Proven Correct!
53mThe Rust Borrow Checker - A Deep Dive
36mThe Rust Borrow Checker: A Deep Dive
21mMind the Boundary: Detecting Undefined Behavior Across Rust’s FFI
15mNon-binary Rust: Between Safe and Unsafe