一句话：提出 OLASan，通过在函数级聚合同一对象的内存访问并配合自定义内存标记与分配器，实现低开销且精确的对象级内存违规检测。
现有 sanitizer 在预发布阶段的缺陷检测中难以兼顾性能与精度，根源在于过度依赖影子内存以及运行时大量内存访问检查，细粒度检测时开销尤为严重。本文提出对象级地址 sanitizer OLASan，其核心思想是关注内存访问与对象之间的关联：在函数级别将同一对象的多次内存访问聚合起来，按需执行有针对性的检查，从而避免在运行时检查绝大多数内存访问。OLASan 刻画了多种内存访问模式以识别可聚合的访问，并借助自定义内存标记（memory tagging）实现内存安全检查。作者在 LLVM 框架上实现了 OLASan，并在 SPEC CPU 基准上评测。结果表明，OLASan 的运行时开销分别比 ASan、ASan-- 和 GiantSan 低 51.18%、25.20% 和 6.52%；在 Juliet 测试集上，借助自定义内存标记首次实现零漏报；对真实漏洞的检测能力也与现有方法相当。
To mitigate potential memory safety vulnerabilities, recently there have been significant advances in sanitizers for pre-production bug detection. However, the limited inability to balance performance and detection accuracy still holds. The main reason is due to excessive reliance on shadow memory and a large number of memory access checks at runtime, incurring a significant performance overhead (if fine-grained memory safety detection is performed, the overhead will be even greater). In this paper, we propose a novel Object-Level Address Sanitizer OLASan to reduce performance overhead further while implementing accurate memory violations (including intra-object overflow) detection. Unlike previous sanitizers ignoring the correlation between memory access and objects, OLASan aggregates multiple memory accesses of same object at function level to perform on-demand targeted sanitization, thus avoiding examining most memory accesses at runtime. Specifically, OLASan characterizes various memory access patterns to identify those which can be aggregated, and implements memory safety checks with customized memory tagging. We implement OLASan atop the LLVM framework and evaluate it on SPEC CPU benchmarks. Evaluations show that OLASan outperforms the state-of-the-art methods with 51.18%, 25.20% and 6.52% less runtime overhead than ASan, ASan-- and GiantSan respectively. Moreover, aided by customized memory tagging, OLASan achieves zero false negatives for the first time when testing Juliet suites. Finally, we confirm that OLASan also offers comparable detection capabilities on real bugs.
DOI 原文 ·
@inproceedings{paperbot8877,
title = {Practical Object-Level Sanitizer with Aggregated Memory Access and Custom Allocator},
author = {Xiaolei Wang and Ruilin Li and Bin Zhang and Chao Feng and Chaojing Tang},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00213}
}