DBG-300 · Debugging & Tracing
Kernel Concurrency, Memory Corruption & Sanitizers
Hunt the bugs that only trigger under load: data races, lock contention, use-after-free and memory corruption using lockstat, KCSAN, KASAN, KFENCE and syzkaller.
Who this course is for
Kernel developers, driver maintainers, and low-level software engineers debugging elusive intermittent bugs: memory corruptions, data races, deadlocks, and use-after-free conditions.
Prerequisites
Course outline
Day 1 — Race conditions & concurrency debugging
- Anatomy of a data race: unsynchronized concurrent accesses and compiler register caching
- Kernel Concurrency Sanitizer (KCSAN): compile-time instrumentation and watchpoint architecture
- Reproducing races: stress harnesses, CPU frequency modulation, and synthetic scheduling contention
- Lock contention profiling: lockdep lock validation, lockstat, and perf lock diagnostics
Day 2 — Memory corruption classes & mechanisms
- Common kernel memory corruptions: use-after-free, out-of-bounds, double free, and uninitialized reads
- Slab and buddy allocator layout: how memory corruptions remain silent until innocent code crashes
- Poisoning, redzones, and allocator integrity checks (CONFIG_SLAB_FREELIST_HARDENED)
- Diagnosing wild pointer dereferences and kernel heap buffer overflows
Day 3 — In-kernel sanitizers: KASAN & KFENCE
- Kernel Address Sanitizer (KASAN): shadow memory mechanics, compile-time checks, and performance cost
- Kernel Electric-Fence (KFENCE): low-overhead sampling memory safety for production kernels
- Analyzing KASAN and KFENCE error reports: allocation/free stack traces and object dumps
- Kernel Memory Sanitizer (KMSAN) for uninitialized memory and UndefinedBehaviorSanitizer (UBSAN)
Day 4 — Automated bug hunting with syzkaller
- Coverage-guided kernel fuzzing: how syzkaller discovers unreachable corner cases
- Defining syzkaller system call descriptions (syzlang) for custom drivers and subsystems
- Reproducing and minimizing syzkaller crash reports down to standalone C reproducer scripts
- Architectural patterns that prevent memory and concurrency bugs by construction
What you build
Not exercises with a known answer. Each project is built, measured and defended by you, on hardware and a kernel version you actually run — so the result is something you can take back to your team.
The race condition reproducer
Construct a deterministic stress harness that reliably reproduces a subtle timing race in a kernel module within 30 seconds, capturing KCSAN verification traces.
You leave witha stress test script and KCSAN diagnostic log verifying the race condition
KASAN vs KFENCE comparison suite
Implement controlled memory corruption tests (out-of-bounds, use-after-free, double free) and document how KASAN and KFENCE detect each, comparing overhead and detection latency.
You leave witha benchmark and diagnostic report detailing sanitizer tradeoffs for production vs development
Syzkaller driver grammar & fuzzer
Write syzlang interface descriptions for a custom device driver and run syzkaller to discover edge-case input crashes, producing a minimized standalone C reproducer.
You leave withsyzlang grammar definitions and a standalone reproducer demonstrating an isolated edge-case crash
Hands-on labs
Labs follow the academy model — 35% principles, 20% guided investigation, 45% engineering studio. Every claim you make in a lab is backed by a trace, a counter or a measurement you captured yourself. How we teach
- Lab: instrument a race-prone kernel module with KCSAN and capture a live concurrent data race report
- Lab: profile lock contention in a multi-threaded benchmark using lockstat to identify bottleneck mutexes
- Lab: trigger an out-of-bounds slab write and analyze the resulting KASAN shadow memory report
- Lab: deploy KFENCE on a running system and detect an intermittent use-after-free bug under load
- Lab: take a raw syzkaller crash log and compile a standalone C program that deterministically panics the kernel
Capstone project
Given a buggy, proprietary device driver that intermittently panics under multi-core stress, employ KCSAN and KASAN to isolate both a data race and a use-after-free condition, write an automated reproducer, and deliver the patch that resolves both defects.
What you leave with
- The ability to track down and eliminate bugs that only appear under production load
- Mastery of KASAN, KFENCE, and KCSAN for proactive bug hunting
- Fluency analyzing lock contention using lockdep and lockstat
- Working knowledge of coverage-guided kernel fuzzing and reproducer minimization
How it runs
Every course follows the same model: 35% principles, 20% guided investigation, 45% engineering studio. You leave with working code, raw measurements and an evidence-based report — not a certificate of attendance. Read the methodology or see a full sample lesson.
Material is adapted to your kernel version, hardware and workload before a private delivery. For public cohorts, the environment is provided and configured.
Questions
Who is this course for?
Kernel developers, driver maintainers, and low-level software engineers debugging elusive intermittent bugs: memory corruptions, data races, deadlocks, and use-after-free conditions. It sits at advanced level within the Debugging & Tracing track.
What do I need to know already?
Specific prerequisites for this course: Strong C programming skills; Experience developing or inspecting Linux kernel modules; Comfort reading assembly language. We confirm levels before the cohort starts and adapt if a group is stronger or weaker than expected.
Can this run privately for my team?
Yes. Any course runs on-site at your offices anywhere, or live online for a distributed team, with labs adapted to your hardware and codebase.
What is the difference between in-person and online?
In person is 4 full days with hardware on your desk, capped at 14. Online is 8 half-day sessions across about two weeks so you can keep working, capped at 20, with remote lab access.
Do you invoice companies?
Yes. Purchase orders are accepted and invoicing is available in USD, EUR, GBP, SAR and CAD.
Upcoming dates
| Dates | Where | Seats | Early bird | Regular | |
|---|---|---|---|---|---|
| 22 Nov – 25 Nov 20264 full days | RiyadhIn person · KAFD Conference Centre | 6 of 14 | SAR 13,500until 23 Oct | ||
| 22 Nov – 25 Nov 20264 full days | Kuwait CityIn person · Al Hamra Tower | 11 of 14 | US$3,600until 23 Oct | ||
| 29 Nov – 2 Dec 20264 full days | MuscatIn person · Knowledge Oasis Muscat | 6 of 14 | US$3,600until 30 Oct | ||
| 6 Dec – 15 Dec 20268 half-days | Gulf bandLive online · 09:00–13:00 GMT+3 | 18 of 20 | US$2,610until 6 Nov | ||
| 7 Dec – 10 Dec 20264 full days | OttawaIn person · Kanata North Tech Park | 11 of 14 | CAD 4,900until 7 Nov | ||
| 7 Dec – 10 Dec 20264 full days | TorontoIn person · MaRS Discovery District | 6 of 14 | CAD 4,900until 7 Nov | ||
| 7 Dec – 16 Dec 20268 half-days | Europe bandLive online · 09:00–13:00 CET | 7 of 20 | US$2,610until 7 Nov | ||
| 14 Dec – 17 Dec 20264 full days | LondonIn person · Shoreditch Works | 11 of 14 | GBP 2,810until 14 Nov | ||
| 14 Dec – 23 Dec 20268 half-days | Americas bandLive online · 13:00–17:00 ET | 12 of 20 | US$2,610until 14 Nov | ||
| 21 Dec – 24 Dec 20264 full days | BerlinIn person · Factory Görlitzer Park | 6 of 14 | EUR 3,310until 21 Nov |
Dates shown for the next few months. If nothing fits, tell us where and when — cohorts are added on demand, and private delivery can be scheduled any week.
More in Debugging & Tracing
DBG-1014 days
Kernel Crash Dump Analysis & Live Debugging
From raw panic splats and kdump vmcores to live interactive stepping: diagnose kernel panics, hangs and corrupted state with crash and kgdb.
Practitioner-taught
SAR 15,000Next 11 Oct
DBG-2014 days
Kernel Tracing & Profiling with ftrace & perf
Dynamic in-kernel instrumentation, latency analysis, and hardware profiling: master ftrace, trace-cmd, and perf to turn execution anomalies into actionable flame graphs.
Practitioner-taught
SAR 12,000Next 1 Nov
DBG-2204 days
eBPF & bpftrace Systems Observability
Programmable in-kernel observability: write one-liners for instant production answers and build safe, high-performance tracing tools with bpftrace and libbpf CO-RE.
Practitioner-taught
SAR 15,000Next 15 Nov