Compiler Attributes: Add __counted_by macro
PATCH v2 1/1 Compiler Attributes: Add __counted_by macro
In an effort to annotate all flexible array members with their run-time size information, the "element_count" attribute is being introduced by Clang[1] and GCC[2] in future releases. This annotation will provide the CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE features the ability to perform run-time bounds checking on otherwise unknown-size flexible arrays.
Even though the attribute is under development, we can start the annotation process in the kernel. This requires defining a macro for it, even if we have to change the name of the actual attribute later. Since it is likely that this attribute may change its name to "counted_by" in the future (to better align with a future total bytes "sized_by" attribute), name the wrapper macro "__counted_by", which also reads more clearly (and concisely) in structure definitions.
[1] https://reviews.llvm.org/D148381
[2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
---
v2: - update "Optional" comments
v1: https://lore.kernel.org/all/[email protected]/
--- include/linux/compiler_attributes.h | 13 +++++++++++++ 1 file changed, 13 insertions(+)
include/linux/compiler_attributes.h +13 -0
@@ -123,6 +123,19 @@# define __designated_init#endif +/* +* Optional: only supported since gcc >= 14 +* Optional: only supported since clang >= 17 +* +* gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896 +* clang: https://reviews.llvm.org/D148381 +*/ +#if __has_attribute (__element_count__) +# define __counted_by (member) __attribute__((__element_count__(member))) +#else +# define __counted_by (member) +#endif +/* * Optional: only supported since clang >= 14.0 *
Signature · 1 line
2.34.1
Quoted 18 lines · Kees Cook
In an effort to annotate all flexible array members with their run-time size information, the "
element_count" attribute is being introduced by Clang[1] and GCC[2] in future releases. This annotation will provide theCONFIG_UBSAN_BOUNDSandCONFIG_FORTIFY_SOURCEfeatures the ability to perform run-time bounds checking on otherwise unknown-size flexible arrays.Even though the attribute is under development, we can start the annotation process in the kernel. This requires defining a macro for it, even if we have to change the name of the actual attribute later. Since it is likely that this attribute may change its name to "
counted_by" in the future (to better align with a future total bytes "sized_by" attribute), name the wrapper macro "__counted_by", which also reads more clearly (and concisely) in structure definitions.[1] https://reviews.llvm.org/D148381
[2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
Quoted 9 lines
Cc Miguel Ojeda <[email protected]>Cc Bill Wendling <[email protected]>Cc Qing Zhao <[email protected]>Cc Gustavo A. R. Silva <[email protected]>Cc Nick Desaulniers <[email protected]>Cc Nathan Chancellor <[email protected]>Cc Tom Rix <[email protected]>Signed-off-by Kees Cook <[email protected]>
Thanks
--
Gustavo
Quoted 34 lines
---
v2: - update "Optional" comments
v1: https://lore.kernel.org/all/[email protected]/--- include/linux/compiler_attributes.h | 13 +++++++++++++ 1 file changed, 13 insertions(+)include/linux/compiler_attributes.h +13
-0@@ -123,6 +123,19 @@# define __designated_init#endif +/* +* Optional: only supported since gcc >= 14 +* Optional: only supported since clang >= 17 +* +* gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896 +* clang: https://reviews.llvm.org/D148381 +*/ +#if __has_attribute (__element_count__) +# define __counted_by (member) __attribute__((__element_count__(member))) +#else +# define __counted_by (member) +#endif +/* * Optional: only supported since clang >= 14.0 * Signature · 1 line
2.34.1
Quoted 18 lines · Kees Cook
In an effort to annotate all flexible array members with their run-time size information, the "
element_count" attribute is being introduced by Clang[1] and GCC[2] in future releases. This annotation will provide theCONFIG_UBSAN_BOUNDSandCONFIG_FORTIFY_SOURCEfeatures the ability to perform run-time bounds checking on otherwise unknown-size flexible arrays.Even though the attribute is under development, we can start the annotation process in the kernel. This requires defining a macro for it, even if we have to change the name of the actual attribute later. Since it is likely that this attribute may change its name to "
counted_by" in the future (to better align with a future total bytes "sized_by" attribute), name the wrapper macro "__counted_by", which also reads more clearly (and concisely) in structure definitions.[1] https://reviews.llvm.org/D148381
[2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896
Quoted 9 lines
Cc Miguel Ojeda <[email protected]>Cc Bill Wendling <[email protected]>Cc Qing Zhao <[email protected]>Cc Gustavo A. R. Silva <[email protected]>Cc Nick Desaulniers <[email protected]>Cc Nathan Chancellor <[email protected]>Cc Tom Rix <[email protected]>Signed-off-by Kees Cook <[email protected]>
Quoted 34 lines
---
v2: - update "Optional" comments
v1: https://lore.kernel.org/all/[email protected]/--- include/linux/compiler_attributes.h | 13 +++++++++++++ 1 file changed, 13 insertions(+)include/linux/compiler_attributes.h +13
-0@@ -123,6 +123,19 @@# define __designated_init#endif +/* +* Optional: only supported since gcc >= 14 +* Optional: only supported since clang >= 17 +* +* gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896 +* clang: https://reviews.llvm.org/D148381 +*/ +#if __has_attribute (__element_count__) +# define __counted_by (member) __attribute__((__element_count__(member))) +#else +# define __counted_by (member) +#endif +/* * Optional: only supported since clang >= 14.0 * Signature · 1 line
2.34.1
Quoted 8 lines · Kees Cook
In an effort to annotate all flexible array members with their run-time size information, the "
element_count" attribute is being introduced by Clang[1] and GCC[2] in future releases. This annotation will provide theCONFIG_UBSAN_BOUNDSandCONFIG_FORTIFY_SOURCEfeatures the ability to perform run-time bounds checking on otherwise unknown-size flexible arrays.[...]
FYI, applied to for-next/hardening:
[1/1] Compiler Attributes: Add __counted_by macro
https://git.kernel.org/kees/c/86a76e91cbab
Signature · 1 line
Kees Cook
Miguel Ojeda
Acked-byQuoted 5 lines · Kees Cook
FYI, applied to for-next/hardening:
[1/1] Compiler Attributes: Add
__counted_bymacrohttps://git.kernel.org/kees/c/86a76e91cbab
Sorry, I was going to apply it soon -- in case you want it:
And thanks Nathan for resubmitting the Reviewed-by from v1!
Cheers,
Miguel
Quoted 10 lines · Miguel Ojeda
Quoted 5 lines · Kees Cook
FYI, applied to for-next/hardening:
[1/1] Compiler Attributes: Add
__counted_bymacrohttps://git.kernel.org/kees/c/86a76e91cbabSorry, I was going to apply it soon -- in case you want it:
Acked-by Miguel Ojeda <[email protected]>
Thanks!
Quoted 1 line
And thanks Nathan for resubmitting the
Reviewed-byfrom v1!
Yes, apologies for missing this in my v2 submission!
Signature · 1 line
Kees Cook
Quoted 13 lines · Kees Cook
Quoted 10 lines · Miguel Ojeda
Quoted 5 lines · Kees Cook
FYI, applied to for-next/hardening:
[1/1] Compiler Attributes: Add
__counted_bymacrohttps://git.kernel.org/kees/c/86a76e91cbabSorry, I was going to apply it soon -- in case you want it:
Acked-by Miguel Ojeda <[email protected]>
Quoted 9 lines
Thanks!
Quoted 1 line
And thanks Nathan for resubmitting the
Reviewed-byfrom v1!Yes, apologies for missing this in my v2 submission!
--
Kees Cook
https://discourse.llvm.org/t/rfc-enforcing-bounds-safety-in-c-fbounds-safety/70854
proposes a macro __counted_by as well.
This patch uses the same name:
Quoted 1 line
# define __counted_by(member) __attribute__((__element_count__(member)))
I wonder whether the two use cases are compatible so that using the same macro name will be fine.
#if defined(__has_feature) && __has_feature(bounds_safety) #define __counted_by(T) __attribute__((__counted_by__(T)))
// ... other bounds annotations
#else
#define __counted_by(T) // defined as nothing // ... other bounds annotations #endif
Signature · 1 line
宋方睿
Quoted 24 lines · Fangrui Song
Quoted 13 lines · Kees Cook
Quoted 10 lines · Miguel Ojeda
Quoted 5 lines · Kees Cook
FYI, applied to for-next/hardening:
[1/1] Compiler Attributes: Add
__counted_bymacrohttps://git.kernel.org/kees/c/86a76e91cbabSorry, I was going to apply it soon -- in case you want it:
Acked-by Miguel Ojeda <[email protected]>Quoted 9 lines
Thanks!
Quoted 1 line
And thanks Nathan for resubmitting the
Reviewed-byfrom v1!Yes, apologies for missing this in my v2 submission!
--
Kees Cook
Quoted 8 lines
https://discourse.llvm.org/t/rfc-enforcing-bounds-safety-in-c-fbounds-safety/70854
proposes a macro__counted_byas well.
This patch uses the same name:Quoted 1 line
# define __counted_by(member) __attribute__((__element_count__(member)))I wonder whether the two use cases are compatible so that using the same macro name will be fine.
Yeah, I have suggest the name change for the GCC proposal. However, given that there is still no code to test for -fbounds-safety, I'm sticking with __element_count for the moment, as there is code implementing that name in both GCC and Clang today.
Quoted 6 lines
#if
defined(__has_feature)&&__has_feature(bounds_safety)#define__counted_by(T)__attribute__((__counted_by__(T)))
// ... other bounds annotations
#else
#define__counted_by(T)// defined as nothing // ... other bounds annotations #endif
Right. My main consideration for getting __counted_by defined by the kernel at all is so that annotation can begin. We can adjust the define's contents as needed. :)
Signature · 1 line
Kees Cook