The TCP/IP stack is perhaps the largest remotely reachable attack surface in the FreeBSD kernel, and most of its exploitable bugs have been out-of-bounds memory accesses. To address this class of security bugs, the FreeBSD Foundation is sponsoring Abhijeet Sharma to adopt Clang’s -fbounds-safety extension across the FreeBSD kernel’s TCP/IP stack.
In C, a pointer and a length value are often passed together, but the compiler cannot connect the two values. With -fbounds-safety, source-code annotations such as __counted_by(n) are used to tie the two together. The compiler can optimize away the bounds check if it can prove that it’s not going to trap. An out-of-bounds access, such as a TCP segment whose option length field claims more data than the packet carries, becomes a clean, diagnosable kernel trap instead of silent memory corruption. During rollout, the checks can also run in a soft mode that records violations through DTrace and allows execution to continue, thus reducing adoption friction.
The annotations used here keep the ordinary one-word pointer layout, so struct layouts and calling conventions are unchanged. The extension also provides wider pointer forms that carry their bounds alongside the address, and those do change layout, so this project confines them to function locals and never lets them cross a boundary between instrumented and uninstrumented code. With that discipline, instrumented and uninstrumented files link together freely, and the stack can be converted gradually, one file at a time.
This project will add annotation macros to FreeBSD’s TCP/IP stack. A key point of the design is that the macros expand to nothing when the compiler is missing the annotation features. The same source continues to build unchanged with the stock toolchain, and the checks can be enabled using a build-time knob. The hope is that support will be accepted upstream in Clang.
This work will add the annotations file-by-file to parts of the TCP/IP stack, prioritizing input that could be attacked, such as SACK processing, segment reassembly, TCP Fast Open cookie validation, the SYN cache, and the routines that parse and generate TCP options for every segment. Each annotated file must pass the existing netinet test suites on both amd64 and arm64.
Beyond the annotations themselves, deliverables include a checked mbuf accessor, regression tests that verify deliberate bounds violation traps, continuous integration coverage, a performance report comparing instrumented and stock kernels, and an adoption guide for other kernel subsystems.