Enhancing Spatial Safety: Better Array-bounds Checking in C (and Linux)
summary
Shows concrete fixes: replaces __builtin_object_size mode-zero with mode-one to stop the original "bad vibes" memcpy overflow, adds annotations using counted_by attribute (Clang 18 / GCC 15+) and uses -fstrict-flex-arrays to treat only C99 flexible members as variable length. Work audits ~60,000 warnings down to ~650 unique issues, converts years-old one/zero-length fake flex arrays with struct_size and KC_ALLOC fixes over five years, and adds runtime checks via building_dynamic_object_size — and it works.
AI-written summary · about
chapters (12)
- 0:00Spatial safety in C
- 1:26Agenda
- 2:28C array basics
- 10:02Flexible arrays in kernel
- 13:29BleedingTooth vulnerabilities
- 20:38Object size function internals
- 27:43Fixing false positives with STRUCT_GROUP
- 33:27Trailing array ambiguity
- 40:39Flexible array challenges
- 51:05Counted by attribute
- 59:32Counted by for pointers
- 1:03:50Compiler hardening summary
related talks
47mChallenges and Innovations Towards Spatial Safety in the Linux Kernel
46mProgress On Bounds Checking in C and the Linux Kernel
46mFlexible Array Transformations and Array-bounds Checking
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
46mMeaningful Bounds Checking in the Linux Kernel
52mNon-conforming C++: the Secrets the Committee Is Hiding From You
01h 30mDangerous Optimizations in C and C++ Programming Languages
44mWhere are we on security features?