Challenges and Innovations Towards Spatial Safety in the Linux Kernel
summary
Work since 2019 replaces ad‑hoc trailing arrays with C99 flexible array members, fixes an 8‑year bug, and changes memcpy fortification to use build_dynamic_object_size (mode 1), yielding runtime bounds checks for many cases. Compiler features used: strict-flex-arrays (GCC13/Clang16, enabled in Linux 6.5) and the counted_by attribute (GCC15/Clang18). Scans find ~60k warnings, reduced unique issues from ~600 to ~300 so far; about 1% prove to be real bugs, and the hardening already prevents whole classes of OOB exploits.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:25Array safety basics
- 9:51Kernel hardening origin
- 10:11BleedingTooth vulnerabilities
- 13:23Fortifying memcpy
- 15:34__builtin_object_size modes
- 18:48Cross-member overflows
- 22:23Trailing arrays ambiguity
- 27:25Fixing trailing arrays
- 31:18counted_by attribute
- 34:19Dynamic object size
- 36:52Flexible arrays in structs
- 40:28Flexible array misuse
- 43:37Summary
related talks
01h 10mEnhancing Spatial Safety: Better Array-bounds Checking in C (and Linux)
35mUpstream Kernel Hardening: Progress on Enabling -Wflex-array-member-not-at-end
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
46mProgress On Bounds Checking in C and the Linux Kernel
44mWhere are we on security features?
52mKernel Hardening: Ten Years Deep
45mGCC's -fanalyzer and the Linux kernel
39mControl Flow Integrity in the Linux Kernel