Speaker
Description
KASAN (Kernel Address Sanitizer) is a powerful developer tool for detecting
use-after-free and out-of-bounds memory accesses in the kernel code.
However, not all memory accesses performed by the kernel are covered by
KASAN monitoring. BPF programs are a major example: when they are
translated by the in-kernel JIT compiler, the kernel directly emits new
native instructions that then escape KASAN instrumentation. Closing this
gap would shed some light on potential bugs in the eBPF verifier or JIT
compilers that would be hard to investigate otherwise.
This talk will present the current effort funded by the eBPF Foundation
aiming to introduce KASAN support for eBPF programs: we will discuss the
main architectural points, going over how the JIT compiler emits calls to
__asan_*() functions before each memory access, discussing the register
save/restore strategy, and the interactions with the BPF verifier.
As a first draft of this work has been introduced at the LSFMMBPF
conference 2026 (Zagreb, Croatia), and as many revisions have been sent and
discussed on the BPF mailing list since then, this talk will also act as an
update, highlighting the main changes since the first draft, as well as the
remaining difficulties and issues to solve.