Enhancing Spatial Safety: Better Array-bounds Checking in C (and Linux)

on YouTube ↗01h 12m

" summary

Six years of kernel hardening turns into concrete fixes: memcpy is rewritten to use __builtin_object_size(mode=1) then __builtin_dynamic_object_size paired with the new counted_by attribute (Clang 18 / GCC 15) so flexible members get runtime bounds checks, and -fstrict-flex-arrays=3 lands in Linux 6.5 after a five-year push converting one‑element and zero‑length arrays to true flex members. A true_group macro removes hundreds of false positives; one flag initially reports >60,000 warnings (650 unique) and the changes are enabled via CONFIG_FORTIFY_SOURCE.

AI-written summary · about

" chapters (10)

1. 0:00Spatial safety in C
2. 3:12Arrays and flexible members
3. 12:26Flexible arrays in Linux
4. 21:19Hardening memcpy
5. 29:53Trailing array ambiguity
6. 36:13Strict flex arrays
7. 43:18Flexible array challenges
8. 51:46Counted by attribute
9. 1:00:12BleedingTooth hardening
10. 1:03:26Conclusions

" related talks

• 47mChallenges and Innovations Towards Spatial Safety in the Linux KernelGustavo A. R. Silva · Open Source Summit Europe 2024
• 46mProgress On Bounds Checking in C and the Linux KernelGustavo A. R. Silva, Kees Cook · Linux Security Summit North America 2023
• 35mUpstream Kernel Hardening: Recent Progress and ChallengesGustavo A. R. Silva · Open Source Summit Korea 2026
• 40mUpstream Kernel Hardening: Progress on Enabling -Wflex-array-member-not-at-endGustavo A. R. Silva · Open Source Summit Europe 2025
• 54mSecurity Features status updateKees Cook, Qing Zhao, Bill Wendling · Linux Plumbers Conference 2023
• 52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux KernelKees Cook, James Morris · Linux Security Summit North America 2022
• 34mMaking C Less DangerousKees Cook · Linux Security Summit North America 2018
• 01h 26mA Path to Practically Safe C++Yitzhak Mandelbaum · C++Now 2026