DBG-300 · Debugging & Tracing · Advanced
Kernel Concurrency, Memory Corruption & Sanitizers — full syllabus
Hunt the bugs that only trigger under load: data races, lock contention, use-after-free and memory corruption using lockstat, KCSAN, KASAN, KFENCE and syzkaller.
Duration4 full days in person · 8 half-days online
Cohortmax 14 in person · 20 online
Pricefrom SAR 15,000 in person · local pricing per city
Delivery35% principles · 20% guided investigation · 45% engineering studio
Who this course is for
Kernel developers, driver maintainers, and low-level software engineers debugging elusive intermittent bugs: memory corruptions, data races, deadlocks, and use-after-free conditions.
Prerequisites
- Strong C programming skills
- Experience developing or inspecting Linux kernel modules
- Comfort reading assembly language
Course outline
Day 1 — Race conditions & concurrency debugging
- Anatomy of a data race: unsynchronized concurrent accesses and compiler register caching
- Kernel Concurrency Sanitizer (KCSAN): compile-time instrumentation and watchpoint architecture
- Reproducing races: stress harnesses, CPU frequency modulation, and synthetic scheduling contention
- Lock contention profiling: lockdep lock validation, lockstat, and perf lock diagnostics
Day 2 — Memory corruption classes & mechanisms
- Common kernel memory corruptions: use-after-free, out-of-bounds, double free, and uninitialized reads
- Slab and buddy allocator layout: how memory corruptions remain silent until innocent code crashes
- Poisoning, redzones, and allocator integrity checks (CONFIG_SLAB_FREELIST_HARDENED)
- Diagnosing wild pointer dereferences and kernel heap buffer overflows
Day 3 — In-kernel sanitizers: KASAN & KFENCE
- Kernel Address Sanitizer (KASAN): shadow memory mechanics, compile-time checks, and performance cost
- Kernel Electric-Fence (KFENCE): low-overhead sampling memory safety for production kernels
- Analyzing KASAN and KFENCE error reports: allocation/free stack traces and object dumps
- Kernel Memory Sanitizer (KMSAN) for uninitialized memory and UndefinedBehaviorSanitizer (UBSAN)
Day 4 — Automated bug hunting with syzkaller
- Coverage-guided kernel fuzzing: how syzkaller discovers unreachable corner cases
- Defining syzkaller system call descriptions (syzlang) for custom drivers and subsystems
- Reproducing and minimizing syzkaller crash reports down to standalone C reproducer scripts
- Architectural patterns that prevent memory and concurrency bugs by construction
Hands-on labs
- Lab: instrument a race-prone kernel module with KCSAN and capture a live concurrent data race report
- Lab: profile lock contention in a multi-threaded benchmark using lockstat to identify bottleneck mutexes
- Lab: trigger an out-of-bounds slab write and analyze the resulting KASAN shadow memory report
- Lab: deploy KFENCE on a running system and detect an intermittent use-after-free bug under load
- Lab: take a raw syzkaller crash log and compile a standalone C program that deterministically panics the kernel
Capstone project
Given a buggy, proprietary device driver that intermittently panics under multi-core stress, employ KCSAN and KASAN to isolate both a data race and a use-after-free condition, write an automated reproducer, and deliver the patch that resolves both defects.
What you leave with
- The ability to track down and eliminate bugs that only appear under production load
- Mastery of KASAN, KFENCE, and KCSAN for proactive bug hunting
- Fluency analyzing lock contention using lockdep and lockstat
- Working knowledge of coverage-guided kernel fuzzing and reproducer minimization
Upcoming dates
| Dates | Where | Seats | Early bird | Regular | |
|---|---|---|---|---|---|
| 22 Nov – 25 Nov 20264 full days | RiyadhIn person · KAFD Conference Centre | 6 of 14 | SAR 13,500until 23 Oct | ||
| 22 Nov – 25 Nov 20264 full days | Kuwait CityIn person · Al Hamra Tower | 11 of 14 | US$3,600until 23 Oct | ||
| 29 Nov – 2 Dec 20264 full days | MuscatIn person · Knowledge Oasis Muscat | 6 of 14 | US$3,600until 30 Oct | ||
| 6 Dec – 15 Dec 20268 half-days | Gulf bandLive online · 09:00–13:00 GMT+3 | 18 of 20 | US$2,610until 6 Nov | ||
| 7 Dec – 10 Dec 20264 full days | OttawaIn person · Kanata North Tech Park | 11 of 14 | CAD 4,900until 7 Nov | ||
| 7 Dec – 10 Dec 20264 full days | TorontoIn person · MaRS Discovery District | 6 of 14 | CAD 4,900until 7 Nov | ||
| 7 Dec – 16 Dec 20268 half-days | Europe bandLive online · 09:00–13:00 CET | 7 of 20 | US$2,610until 7 Nov | ||
| 14 Dec – 17 Dec 20264 full days | LondonIn person · Shoreditch Works | 11 of 14 | GBP 2,810until 14 Nov | ||
| 14 Dec – 23 Dec 20268 half-days | Americas bandLive online · 13:00–17:00 ET | 12 of 20 | US$2,610until 14 Nov | ||
| 21 Dec – 24 Dec 20264 full days | BerlinIn person · Factory Görlitzer Park | 6 of 14 | EUR 3,310until 21 Nov |
Book a seat, or bring this course to your team
Seats can be reserved online; private delivery runs on-site or live online, adapted to your stack.
Questions about fit or prerequisites? Email [email protected]. To save this syllabus, print this page to PDF from your browser.