LwRustIP: Memory-safe and efficient embedded networking stack with ownership semantics

Abstract

As modern embedded systems are increasingly network connected, their protocol stacks expose themselves as a surface that is frequently attacked. While C-based implementations such as LwIP are efficient, their lack of memory safety induces critical vulnerabilities such as buffer overflows, dangling pointers, and use-after-free, leading to remote code execution or privilege escalation. In this paper, we present LwRustIP, a memory-safe embedded networking stack reimplemented in Rust and compatible with LwIP. We also share our development experience. LwRustIP replaces unsafe linked-list memory management with a custom allocator that honors the Rust ownership semantics, leverages zero-copy techniques for inter-layer packet handoffs, and applies lock-free object pools for concurrent buffer management. These design choices ensure memory safety while maintaining performance comparable to traditional C-based implementations. We deploy LwRustIP on ARM-based embedded platforms and evaluate its correctness, performance, and memory safety. Experimental results show that LwRustIP achieves memory safety without incurring measurable performance overhead compared to the original C-based implementation. Our experience highlights the practical challenges and benefits of using Rust for low-level system components and offers guidance for future efforts in memory-safe reengineering of legacy C codebases.