MixSan: Enhancing Address-Based Memory Sanitizers with Fused Metadata and Hybrid Detection
TL;DR
MixSan, a prototype built on RangeSanitizer (RSan), stores the same identity tag in pointer high bits through Intel Linear Address Masking (LAM) U57 and validates both the tag and the spatial bound with a unified 3-ALU-op check.
Abstract
During software testing, memory errors in C/C++ can silently corrupt the program state. Address-based memory sanitizers, while offering practical performance and compatibility, are fundamentally unable to distinguish spatial errors that skip redzones or temporal errors that occur after memory reuse. Moreover, their reuse-delay quarantine mechanisms impose significant space and time overhead. We propose a taxonomy of memory sanitizers based on validity encoding and violation detection. Guided by this taxonomy, we introduce fused metadata, a single 8-byte word that encodes an object’s end address and a 6-bit identity tag. MixSan, a prototype built on RangeSanitizer (RSan), stores the same identity tag in pointer high bits through Intel Linear Address Masking (LAM) U57 and validates both the tag and the spatial bound with a unified 3-ALU-op check. On SPEC CPU2006, MixSan incurs a 1.58× geomean runtime overhead, comparable to RSan’s 1.61× overhead. On the Larson allocator benchmark, MixSan and the uninstrumented tcmalloc both scale with thread count, whereas RSan throughput falls; MixSan’s multi-thread plateau is more than 30× that of RSan. In a custom 97-test suite targeting post-reuse temporal errors and redzone-skipping spatial errors, MixSan’s mean single-run detection rate is 98.41% over 104 independent executions per program, matching the theoretical 63/64 rate given a uniform 6-bit tag distribution, whereas ASan and RSan do not detect these constructed cases.