Tech-ASan: Two-stage check for Address Sanitizer

TL;DR

Tech-ASan is a novel two-stage check technique that significantly reduces runtime overhead of Address Sanitizer while maintaining detection accuracy, making memory safety testing more efficient for large software.

Contribution

It introduces a two-stage check algorithm leveraging magic value comparison and an optimizer to eliminate redundant checks, improving ASan's efficiency without compromising safety.

Findings

33.70% less runtime overhead than ASan

Detects 56 fewer false negatives than ASan

Outperforms state-of-the-art methods on SPEC CPU2006

Abstract

Address Sanitizer (ASan) is a sharp weapon for detecting memory safety violations, including temporal and spatial errors hidden in C/C++ programs during execution. However, ASan incurs significant runtime overhead, which limits its efficiency in testing large software. The overhead mainly comes from sanitizer checks due to the frequent and expensive shadow memory access. Over the past decade, many methods have been developed to speed up ASan by eliminating and accelerating sanitizer checks, however, they either fail to adequately eliminate redundant checks or compromise detection capabilities. To address this issue, this paper presents Tech-ASan, a two-stage check based technique to accelerate ASan with safety assurance. First, we propose a novel two-stage check algorithm for ASan, which leverages magic value comparison to reduce most of the costly shadow memory accesses. Second, we design an efficient optimizer to eliminate redundant checks, which integrates a novel algorithm for removing checks in loops. Third, we implement Tech-ASan as a memory safety tool based on the LLVM compiler infrastructure. Our evaluation using the SPEC CPU2006 benchmark shows that Tech-ASan outperforms the state-of-the-art methods with 33.70% and 17.89% less runtime overhead than ASan and ASan--, respectively. Moreover, Tech-ASan detects 56 fewer false negative cases than ASan and ASan-- when testing on the Juliet Test Suite under the same redzone setting.