GCC's -fanalyzer and the Linux kernel
summary
GCC adds the -fanalyzer (landed in GCC 10, use GCC 11+), now ~42 warnings in trunk, and performs symbolic execution to find use-after-free, leaks and taint bugs. Constraint checking currently misreports kernel error-pointer patterns and produces false positives in error.h; that is a known limitation. Prototype work implements tainted_args, a pragma custom address space and a 240-line plugin that lets the analyzer understand copy_from_user/copy_to_user semantics; the prototype successfully built and booted kernel but hits sparse/annotation syntax and per-CPU/RCU corner cases.
AI-written summary · about
chapters (10)
- 0:00Introduction to GCC analyzer
- 6:41Analyzer on Linux kernel
- 9:50Attack surface analysis
- 13:46Prototype taint checks
- 17:22Tainted args attribute
- 23:31Custom address spaces
- 31:47Kernel build challenges
- 37:51GCC release cycle issues
- 41:28Plugin approach benefits
- 42:30Summary and Q&A
related talks
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
01h 29mModern Linux C++ Debugging Tools - Under the Covers
35mDeep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel
35mUpstream Kernel Hardening: Progress on Enabling -Wflex-array-member-not-at-end
47mChallenges and Innovations Towards Spatial Safety in the Linux Kernel
39mControl Flow Integrity in the Linux Kernel
58m“Debugging Linux C++”
25mPreparing RISC-V Linux for RVA23