Linux 5.15 Working Towards Comprehensive Compile-Time & Run-Time Detection Of Buffer Overflows

The latest security effort being pursued by Google's Kees Cook is to provide full compile-time and run-time coverage of all detectable buffer overflows.

This compile/run-time detection of buffer overflows for the Linux kernel would include coverage of such overflows via array indexing or memcpy(), memmove(), and memset() while the str*() functions already boast full coverage.

Kernel developers have been working towards this mission for some time while in Linux 5.15 is a big batch of the buffer overflow detection improvements, including some new common helpers along with other low-level improvements.

Kees Cook noted with the overflow update, "After this series (and the changes that have now landed via netdev and usb), we are so very close to finally being able to build with -Warray-bounds and -Wzero-length-bounds. However, due two recently found corner cases in GCC[3] and Clang[4], I have not included the last two patches that turn on these options, as I don't want to introduce any known warnings to the build. I am expecting to solve them before rc2, though, so hopefully there will be a small follow-up to this series before then."