Upstream Kernel Hardening: Progress on Enabling -Wflex-array-member-not-at-end
summary
GCC's -Wflex-array-member-not-at-end reveals that the kernel had ~60,000 warnings which collapse to about 650 unique issues; work reduces that to roughly 200 remaining by combining concrete fixes: remove unused flex members, replace types with str_group/str_group_tag to avoid duplication, use container_of when code must access the flex payload, allocate on-stack with DECLARE_FLEX/DEFINE_FLEX or a new trailing_overlap helper, and verify layouts with pahole; changes are incremental and patches land in KSPP-driven upstream work.
AI-written summary · about
chapters (13)
- 0:00Linux kernel hardening intro
- 1:24Flexible array members in C
- 4:38Risks of flexible arrays not at end
- 7:0360,000 compiler warnings analyzed
- 9:29Case 1: Removing unused flexible arrays
- 11:15Case 2: Handling used flexible arrays
- 14:46strgroup to avoid code duplication
- 18:57Case 3: Implicit unions with flexible arrays
- 23:37Trailing padding issues
- 27:56Case 4: On-stack implicit unions
- 31:48Trailing overlap for cleaner solutions
- 33:12Hardening strategies evolution
- 34:14Progress and next steps
related talks
47mChallenges and Innovations Towards Spatial Safety in the Linux Kernel
46mProgress On Bounds Checking in C and the Linux Kernel
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
44mWhere are we on security features?
45mGCC's -fanalyzer and the Linux kernel
52mKernel Hardening: Ten Years Deep
43mToolchains for the Future
42mThe Kernel Report