An Integer Overflow Endgame: Compiler and Architecture Support for Default-On Integer Overflow Mitigation

Integer overflow checks are off-by-default in most production settings due to their high overheads. Consequently, many serious vulnerabilities remain unmitigated. We analyze the source of these overheads---in compilers including LLVM (UBSan, Rust), and in processors including x86-64, ARM64, and RISC-V---and show how to eliminate them. Overheads in LLVM stem from how overflow semantics are expressed in LLVM IR. LLVM's current approach, based on intrinsics and branches, interferes with a variety of middle end optimizations. We develop an alternative approach that tracks overflow semantics with metadata, but otherwise leaves LLVM IR unchanged, eliminating this overhead. Overheads in hardware primarily result from current ISA designs, that require doubling the number of μops for checked vs. unchecked arithmetic, stressing the processor pipeline. We show how simple ISA extensions can alleviate this stress, enabling overflow-checked arithmetic to issue as a single μop. We evaluate these extensions through compiler-based emulation on real hardware and simulation in gem5. Our work offers a path to significantly reducing the cost of overflow checks in existing compilers, and demonstrates that integer overflow mitigation can be cheap enough for default-on use in future hardware.