Welcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
summary
Analyzes three years of kernel CVEs and finds 25 heap buffer overflows with 11 memcpy overflows that the compiler could have detected; instruments an allmodconfig build and sees ~35,000 memcpy calls (22,000 unknown size, ~12,000 fully known, ~1,200 dynamic copy-size cases) and ~200–300 intentional cross-member copies to fix. Implements helpers like struct_group and bounded-flex-array/memdup-style APIs, uses -Warray-bounds, -fsanitize=bounds, __builtin_object_size and a temporary unsafe_memcpy, and progressively enables compile- and runtime checks toward a 5.20 kernel roll-out.
AI-written summary · about
chapters (9)
- 0:00Start
- 10:44Array Index Overflow Case
- 12:5011 Memcapi Buffer Overflow Flaws
- 21:35Intentional Cross Member Mem Copy Overflows
- 26:37Background on Flexible Arrays
- 26:48Flexible Array Structure
- 27:51Flexible Arrays
- 39:17Bounded Flex Array Helper
- 44:04Failure Cases
related talks
46mMeaningful Bounds Checking in the Linux Kernel
01h 12mEnhancing Spatial Safety: Better Array-bounds Checking in C (and Linux)
47mChallenges and Innovations Towards Spatial Safety in the Linux Kernel- 47mChallenges and Innovations Towards Spatial Safety in the Linux Kernel
01h 10mEnhancing Spatial Safety: Better Array-bounds Checking in C (and Linux)
25mKernel Self-Protection Project
39mMitigating Integer Overflow in C
35mUpstream Kernel Hardening: Recent Progress and Challenges