Overflowing with Fear: Detecting and Mitigating Implicit Panics in Rust
summary
Rust integer overflow and slice indexing generate implicit panics inserted by the compiler with no warning, creating blind spots for kernel code that handles untrusted inputs. Proposed mitigations include a Clippy lint requiring comments on risky operations, post-optimization analysis by inspecting MIR/LLVM output or doing an assembly grep post-LLVM to find remaining panic calls, stronger typed/wrapped integer types and checked APIs, and a Kconfig option (enabled by default) to toggle overflow checks; several prototypes and CI checks exist but full automation is unfinished.
AI-written summary · about
chapters (7)
- 0:00Introduction to implicit panics
- 1:08Examples of implicit panics
- 7:06Challenges with default panics
- 13:35Safety comments and linting
- 20:21Balancing panic requirements
- 27:03Community adoption of new rules
- 30:11Closing discussion
related talks
39mMitigating Integer Overflow in C
19mCounterexamples in Safe Rust
30mEnsuring Rust Safety: Strategies for Managing Unsafe Rust
50mSmashing the Stack: Let’s Make It Less Fun And Unprofitable!
45mBuilding Safe and Secure Systems in Rust
55mStrong software for a safer future
01h 00mint != safe && int != ℤ
31mValidating Rust for industry: Certification meets formal analysis