(Submission for Usenix Artifact Evaluation) SafeFFI: Efficient Sanitization at the Boundary Between Safe and Unsafe Code in Rust and Mixed-Language Applications

SafeFFI is a system for optimizing memory safety instrumentation in Rust binaries such that checks occur at the boundary between unsafe and safe code, handing over the enforcement of memory safety from the sanitizer to the Rust type system. It consists of a modified Rust compiler that uses modified LLVM sanitizers. Our Rust compiler modifications extract type information about pointers from Rust's Mid-Level Intermediate Representation to differentiate raw (C-like) pointers from safe pointers (e.g. Rust References). It passes information about pointer types and casts between them down to LLVM by automatically annotating LLVM IR during lowering from MIR. The modified LLVM contains our SafeFFI-Library which consumes the pointer type annotation, conducts a conservative pointer type analysis at LLVM IR level, inserts additional sanitizer checks at the boundary between safe and unsafe pointer types, and provides a simple API for existing sanitizers to elide checks for provably safe pointer types. Thus reducing the run-time overhead incurred by unnecessary sanitizer checks.

The submitted artefact has the following main components:

• A README with instructions to build the SafeFFI prototype and reproduce experiments (README.pdf)
• SafeFFI prototype
  • LLVM with our modifications (SafeFFI/llvm-project)
    • find all modifications as Diff file in llvm-patch.diff
    • SafeFFI Library:
      • llvm/lib/Transforms/Instrumentation/SafeFFI.h
      • Modifications to ASAN:
      • llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
      • compiler-rt/lib/asan/asan_rtl.cpp
    • Modifications to HWASAN:
      • llvm/lib/Transforms/Instrumentation/HWAddressSanitizer.cpp
      • compiler-rt/lib/hwasan/hwasan.cpp
    • Modifications to ASAN:
      • llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
      • compiler-rt/lib/asan/asan_rtl.cpp
  • Rust compiler with our modifications (SafeFFI/rust)
    • find all modifications as Diff file in rust-patch.diff
    • the modifications are scattered throughout the rustc codebase. The most important changes are in
      • compiler/rustc_codegen_ssa/src/mir/block.rs
      • compiler/rustc_codegen_ssa/src/mir/place.rs
      • compiler/rustc_codegen_ssa/src/mir/rvalue.rs
      • compiler/rustc_codegen_ssa/src/mir/statement.rs
      • compiler/rustc_codegen_llvm/src/builder.rs
• Evaluation scripts and datasets
  • Performance Benchmarking Suite (SafeFFI/playground/rust-benchmarking-scripts/)
    • This includes scripts to download the crates from crates.io and execute measurements of run-time, compile-time, and elided check statistics. The main script is in: run.py
  • Snapshot of crates.io index for downloading versions of the benchmarked crates appropriate for our rustc version 1.52.0 (SafeFFI/playground/crates.io-index-archive-snapshot-2020-11-20)
  • Known Vulnerability dataset (SafeFFI/safeffi-tests/test/rust)
  • script to execute the tests (test-all-pocs-with-safeffi.py)
  • PoCs taken from ERASan's dataset (ERASan-known-vulnerabilities)
  • PoCs recreated from RustSan's dataset (RustSan-known-vulnerabilities)
  • Test Suite of systematic tests for Mixed-language FFI scenarios (SafeFFI/playground/safeffi-systematic-tests)
  • Measurement Results as CSV tables (SafeFFI/data)
  • Visualization Scripts (SafeFFI/images): Python scripts to visualize the measurement results.