Compiler Attributes: Add __counted_by macro
PATCH 1/1 Compiler Attributes: Add __counted_by macro
In an effort to annotate all flexible array members with their run-time size information, the "element_count" attribute is being introduced by Clang[1] and GCC[2] in future releases. This annotation will provide the CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE features the ability to perform run-time bounds checking on otherwise unknown-size flexible arrays.
Even though the attribute is under development, we can start the annotation process in the kernel. This requires defining a macro for it, even if we have to change the name of the actual attribute later. Since it is likely that this attribute may change its name to "counted_by" in the future (to better align with a future total bytes "sized_by" attribute), name the wrapper macro "__counted_by", which also reads more clearly (and concisely) in structure definitions.
[1] https://reviews.llvm.org/D148381
[2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
--- include/linux/compiler_attributes.h | 12 ++++++++++++ 1 file changed, 12 insertions(+)
include/linux/compiler_attributes.h +12 -0
@@ -123,6 +123,18 @@# define __designated_init#endif +/* +* Optional: future support coming in clang 17 and gcc 14 +* +* gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896 +* clang: https://reviews.llvm.org/D148381 +*/ +#if __has_attribute (__element_count__) +# define __counted_by (member) __attribute__((__element_count__(member))) +#else +# define __counted_by (member) +#endif +/* * Optional: only supported since clang >= 14.0 *
Signature · 1 line
2.34.1
Quoted 9 lines · Kees Cook
In an effort to annotate all flexible array members with their run-time size information, the "
element_count" attribute is being introduced by Clang[1] and GCC[2] in future releases. This annotation will provide theCONFIG_UBSAN_BOUNDSandCONFIG_FORTIFY_SOURCEfeatures the ability to perform run-time bounds checking on otherwise unknown-size flexible arrays.Even though the attribute is under development, we can start the annotation process in the kernel. This requires defining a macro for
And FWIW, I've done a first-pass at this annotation with Coccinelle. There are plenty more to do:
155 files changed, 158 insertions, 158 deletions
Signature · 1 line
Kees Cook
Quoted 2 lines · Kees Cook
+ * Optional: future support coming in clang 17 and gcc 14
Should we just say:
Optional: only supported since clang >= 17
Optional: only supported since gcc >= 14
even if they are in the future? That way we avoid changing it later. If somebody asks, you already say it it is in the future the commit message, so it should be clear enough... :)
And if the compilers end up not supporting it on those versions for some unexpected reason, well, we will need to fix the comment either way.
(I can change it on my side if you prefer)
Thanks!
Cheers,
Miguel
Quoted 9 lines · Miguel Ojeda
Quoted 2 lines · Kees Cook
+ * Optional: future support coming in clang 17 and gcc 14
Should we just say:
Optional: only supported since clang >= 17
Optional: only supported since gcc >= 14
Quoted 7 lines
even if they are in the future? That way we avoid changing it later. If somebody asks, you already say it it is in the future the commit message, so it should be clear enough... :)
And if the compilers end up not supporting it on those versions for some unexpected reason, well, we will need to fix the comment either way.
Yeah, fair point!
Quoted 2 lines
(I can change it on my side if you prefer)
Sure, thanks! (But I'm happy to send a v2 if that's easier for you, too.)
-Kees
Signature · 1 line
Kees Cook
Quoted 6 lines · Kees Cook
In an effort to annotate all flexible array members with their run-time size information, the "
element_count" attribute is being introduced by Clang[1] and GCC[2] in future releases. This annotation will provide theCONFIG_UBSAN_BOUNDSandCONFIG_FORTIFY_SOURCEfeatures the ability to perform run-time bounds checking on otherwise unknown-size flexible arrays.
It's happening! :D
Quoted 12 lines
Even though the attribute is under development, we can start the annotation process in the kernel. This requires defining a macro for it, even if we have to change the name of the actual attribute later. Since it is likely that this attribute may change its name to "
counted_by" in the future (to better align with a future total bytes "sized_by" attribute), name the wrapper macro "__counted_by", which also reads more clearly (and concisely) in structure definitions.[1] https://reviews.llvm.org/D148381
[2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
Quoted 9 lines
Cc Miguel Ojeda <[email protected]>Cc Bill Wendling <[email protected]>Cc Qing Zhao <[email protected]>Cc Gustavo A. R. Silva <[email protected]>Cc Nick Desaulniers <[email protected]>Cc Nathan Chancellor <[email protected]>Cc Tom Rix <[email protected]>Signed-off-by Kees Cook <[email protected]>
Thanks!
--
Gustavo
Quoted 30 lines
--- include/linux/compiler_attributes.h | 12 ++++++++++++ 1 file changed, 12 insertions(+)include/linux/compiler_attributes.h +12
-0@@ -123,6 +123,18 @@# define __designated_init#endif +/* +* Optional: future support coming in clang 17 and gcc 14 +* +* gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896 +* clang: https://reviews.llvm.org/D148381 +*/ +#if __has_attribute (__element_count__) +# define __counted_by (member) __attribute__((__element_count__(member))) +#else +# define __counted_by (member) +#endif +/* * Optional: only supported since clang >= 14.0 * Signature · 1 line
2.34.1
Quoted 18 lines · Kees Cook
In an effort to annotate all flexible array members with their run-time size information, the "
element_count" attribute is being introduced by Clang[1] and GCC[2] in future releases. This annotation will provide theCONFIG_UBSAN_BOUNDSandCONFIG_FORTIFY_SOURCEfeatures the ability to perform run-time bounds checking on otherwise unknown-size flexible arrays.Even though the attribute is under development, we can start the annotation process in the kernel. This requires defining a macro for it, even if we have to change the name of the actual attribute later. Since it is likely that this attribute may change its name to "
counted_by" in the future (to better align with a future total bytes "sized_by" attribute), name the wrapper macro "__counted_by", which also reads more clearly (and concisely) in structure definitions.[1] https://reviews.llvm.org/D148381
[2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
Quoted 9 lines
Cc Miguel Ojeda <[email protected]>Cc Bill Wendling <[email protected]>Cc Qing Zhao <[email protected]>Cc Gustavo A. R. Silva <[email protected]>Cc Nick Desaulniers <[email protected]>Cc Nathan Chancellor <[email protected]>Cc Tom Rix <[email protected]>Signed-off-by Kees Cook <[email protected]>
I agree with Miguel's comment formatting and content suggestions. Thanks for the links, they look good. If we have to update the name of the attribute later, it is not the end of the world, as getting the coversion started at this phase will make the roll out quicker.
Quoted 30 lines
--- include/linux/compiler_attributes.h | 12 ++++++++++++ 1 file changed, 12 insertions(+)include/linux/compiler_attributes.h +12
-0@@ -123,6 +123,18 @@# define __designated_init#endif +/* +* Optional: future support coming in clang 17 and gcc 14 +* +* gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896 +* clang: https://reviews.llvm.org/D148381 +*/ +#if __has_attribute (__element_count__) +# define __counted_by (member) __attribute__((__element_count__(member))) +#else +# define __counted_by (member) +#endif +/* * Optional: only supported since clang >= 14.0 * Signature · 1 line
2.34.1