Challenges and Innovations Towards Spatial Safety in the Linux Kernel
summary
Work since 2019 converts ad hoc trailing arrays into C99 flexible array members, annotates them and hardens memcpy so the kernel uses __builtin_dynamic_object_size mode 1 instead of naive copies; compiler-side fixes include -fstrict-flex-arrays (GCC13/Clang16) and the counted_by attribute (GCC15/Clang18) to give runtime sizes. The effort finds ~60,000 warnings across the tree, reduces a set of ~600 unique cases to ~300 with patches, and surfaces ~3–5 real bugs; the fortified memcpy instrumentation now provides practical bounds checking.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:25Array safety basics
- 9:51Kernel hardening origin
- 10:11BleedingTooth vulnerabilities
- 13:23Fortifying memcpy
- 15:34__builtin_object_size modes
- 18:48Cross-member overflows
- 22:23Trailing arrays ambiguity
- 27:25Fixing trailing arrays
- 31:18counted_by attribute
- 34:19Dynamic object size
- 36:52Flexible arrays in structs
- 40:28Flexible array misuse
- 43:37Summary
related talks
01h 12mEnhancing Spatial Safety: Better Array-bounds Checking in C (and Linux)
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
46mProgress On Bounds Checking in C and the Linux Kernel
35mUpstream Kernel Hardening: Recent Progress and Challenges
40mUpstream Kernel Hardening: Progress on Enabling -Wflex-array-member-not-at-end
34mMaking C Less Dangerous
46mMeaningful Bounds Checking in the Linux Kernel
40mUpstream Kernel Hardening: Progress on Enabling -Wflex-array-member-not-at-end