On Fri, 17 Jul 2026 at 14:50, Jinchao Wang <[email protected]> wrote: > > Motivation > ========== > > The hardest memory corruption bugs are the silent ones: a rogue writer > scribbles over a live object through a stale pointer or a race, and
The stale/dangling pointer (use-after-free) case is the main one you're after? > the victim crashes in a code path far away from the culprit. Any > single developer hits such a bug rarely, but across the kernel's code > base and install base they keep arriving, and each one is > disproportionately expensive to localize. The question to answer is > "who wrote to this object, and from where?", and it is hard to get at > with the existing tools: > > - The kernel's own reports - an oops on a clobbered pointer, a > BUG_ON, a list-corruption warning - fire at the victim's access, > not at the corrupting write. > - KASAN/KFENCE catch memory-safety violations: out-of-bounds > accesses and use-after-free. But they have a blind spot: a > corrupting write can be fully memory-safe - a *valid* pointer, in Language-semantically speaking, a use-after-free write to recycled memory (be it in heap or stack) is NOT memory-safe. The detectors may not always catch these (KASAN relies on quarantine for that to increase the chances, but yeah, not guaranteed..). > bounds, to a live object, written just at the wrong time or to the > wrong place - and then they stay silent by design. And even for > the bugs they can catch, KASAN's rebuild, overhead and redzones > change timing and layout enough that racy corruption often no > longer reproduces. There's also tag-based KASAN (KASAN_SW_TAGS or KASAN_HW_TAGS), of which KASAN_SW_TAGS has an x86 version based on LAM (not yet merged though? see https://lwn.net/ml/all/[email protected]/). One property of tag-based schemes (and any other lock+key detection scheme) is that upon recycling some memory, the tag (or key) to that location changes, and any previous pointer that still has the old tag will fault. The caveat with current pointer-tagging schemes is that entropy is relatively low (4 bit tags).
