From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18C16C35FF3 for ; Mon, 17 Mar 2025 16:22:52 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 393E5280003; Mon, 17 Mar 2025 12:22:51 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 3430B280001; Mon, 17 Mar 2025 12:22:51 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1E479280003; Mon, 17 Mar 2025 12:22:51 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 043D5280001 for ; Mon, 17 Mar 2025 12:22:50 -0400 (EDT) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id D0A1314031C for ; Mon, 17 Mar 2025 16:22:51 +0000 (UTC) X-FDA: 83231561742.30.EF71A18 Received: from nyc.source.kernel.org (nyc.source.kernel.org [147.75.193.91]) by imf16.hostedemail.com (Postfix) with ESMTP id 150B6180012 for ; Mon, 17 Mar 2025 16:22:49 +0000 (UTC) Authentication-Results: imf16.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=rFYdRWCR; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf16.hostedemail.com: domain of kees@kernel.org designates 147.75.193.91 as permitted sender) smtp.mailfrom=kees@kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1742228570; a=rsa-sha256; cv=none; b=tyhLhlvld6B0Urd+2oFMMhPpsdXp287kY4UQV0IasGZv9l+RXHyFdfz0oU35/pg/GtLVph bpoF5K8N31kKdovHdajszXvMShwSBJgKcvoebYyuvDORdx5+L4za51ykjDXUmvbdd+FbR0 QMX9iCLyK7YE7oKUplP3k5Yfe6SF1O4= ARC-Authentication-Results: i=1; imf16.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=rFYdRWCR; dmarc=pass (policy=quarantine) header.from=kernel.org; spf=pass (imf16.hostedemail.com: domain of kees@kernel.org designates 147.75.193.91 as permitted sender) smtp.mailfrom=kees@kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1742228570; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=qH6GR/pdW5nUM/qEhXAxmY5LEvkYnNVoViaON+H3+8A=; b=a6iGl3E0iQOE6d5Z9X3ITivy1uvefE79BjdxPzrd8AE/VZXrpuAfhZCQvnZsEzEmoDU+OK E/l3LIQisD7MYSYJM+d5EShcMTwd7Ok0HGOqGzswqsJZFewuX84FWqWpJpMGed3/9e0dIj e5Y9BPQoFOxQ2U/C3wE4pDnQbG24zi8= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by nyc.source.kernel.org (Postfix) with ESMTP id 9D368A4650F; Mon, 17 Mar 2025 16:17:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F3D4AC4CEED; Mon, 17 Mar 2025 16:22:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1742228569; bh=dRUIl3yQcLybI+RJ6oaOQPFfyifr9VBzmEcrLKujw2A=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=rFYdRWCRMHtn3ek5pOSVea3e1aV3dB3WZkMmGn14i+pVDV70xQ4NY4R/ZlTkyS86C HGEpT+dhq4uqjcBnp1l01qCouQcDLlbj5wo9QOTOFkc7pQMauL03MlK9Y4h3XhlRxh cnup+q58QqMDwCuZn/G0pO3SmEuZT+0rrpjuXzn5U1gE9tEdYIF2XFctyrV6Z/YrXu vMXqUWKB4xXGT75JveTVA6Oblr++7aq8T0SPVv/gnlvDtVtsH6QScGRc+4IUhUCZ+d /xcMHRSGWcLrC/nuHlZIvmcLTNxXmfazqGOGiM4370sgCS3bSRyyCTmGT9+Rmo71w2 26zc6VcvZZdLw== Date: Mon, 17 Mar 2025 09:22:46 -0700 From: Kees Cook To: Przemek Kitszel Cc: Vlastimil Babka , Miguel Ojeda , "Gustavo A. R. Silva" , Nathan Chancellor , Peter Zijlstra , Nick Desaulniers , Marco Elver , linux-hardening@vger.kernel.org, Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Bill Wendling , Justin Stitt , Jann Horn , Linus Torvalds , Greg Kroah-Hartman , Sasha Levin , Jonathan Corbet , Jakub Kicinski , Yafang Shao , Tony Ambardar , Alexander Lobakin , Jan Hendrik Farr , Alexander Potapenko , linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-doc@vger.kernel.org, llvm@lists.linux.dev Subject: Re: [PATCH v4 1/2] compiler_types: Introduce __flex_counter() and family Message-ID: <202503170918.A53A0F2@keescook> References: <20250315025852.it.568-kees@kernel.org> <20250315031550.473587-1-kees@kernel.org> <44a00ad4-b05d-4fb8-87f2-fccbaa068872@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <44a00ad4-b05d-4fb8-87f2-fccbaa068872@intel.com> X-Rspam-User: X-Rspamd-Queue-Id: 150B6180012 X-Rspamd-Server: rspam05 X-Stat-Signature: buszjy6j86ii4ykd6nihhtxiaawkddjk X-HE-Tag: 1742228569-456773 X-HE-Meta: U2FsdGVkX19LyzTFyCZr15xP/zhmsYZNMb+d5eUE09mwW6qounKGOTZiGoL/5+Te2TD8JM/V3VYfDRNzCumuXgeFFbBDb1Oo8MJ6EVwkPF6XisyOEy5fgLLa9N5Je13s+T//dVCIcN1FZJiXn6x7zDjcAFWMKo8kYsP/kruFA9PZZuFLBsjkMLgJ1eN1u51NR3qOgGb7jN+l9UVZKCzaI7aQmlX5FHHAnL+5aesRPEAevLTRRX8ZjkLARw2BRT7JDLwSngQSvqQ9spOEwy7ftj+qkJgYQuiJTQHyjXC4XrfVLa+tMdAJhHzqumTfRhPYc7K1ElN+gWgyCrigANEontABQu9hzzQYHESjThDqYLe0zTYiLVGoYE7r8d6NrE0Y5NyW+Oko4wPpCp9U/PW0WEuGf8CN3PMWVmBQYkGx2w9ArhEzpJTvlOIG56Vfw0ZSDp3FZ42hHxehgG3n4hGfE7gKFB+ReLZp5VpxqazGECtmGPSp+egV3ULVXX22UzUvit6+bJkN57D3q4DlWGb6MBxMYQplXvaZvAiHzk1VTj4DtnWGWa92qc/P5bppsLNKq2nKPEsNpu9kh8Wifd+OCmjcA3BkAkzKSSbzS80acNmnDhZCm8et3/WDLkM0qMPAH0ffBQ2374bV6O33D8/mRzziXmlw8/Ub5I4vdrKifbL+nqG8mRXgu30DelajA9piT2/XNvSrKzkvylTm0j5ADNyUQ6mGbbDNbuDVQ4gCVzVGnjs6RMlmHKv+DseW8VR5XLADdaX8N21MjEICgFhx72BlBmuRCOIQC62MVUgkpVRMM9lIikHAfkHC+fTI92tDGYM6s5+TOMY2Y1HAwZ+YHUHjL0pgKIaO+ziQ5OnALWu1VWELjFEalGs6XC5KM3UCsQ79PhzJyJjaR2PlnP07ZRONJT1an69x8lSLZr+VRoQf1eaPh2RMAttk/R0/KzWuLAErAzdNvYYAJYIOkSh X2T/aQ/B UPY+PUTYaFCUhVclxGYIw2z1czRej/CTu15gewddtKaE1L9cGMxTiG14pUNOPXw4rCvhFnZ13Rg//PM/2du4V04XhhoToza5a4+Au6zL+LENJIKuTew1i4f/qoOSB9kFKXFBi8/mU13z9gIeXAAIQtS8HwgzzgwwZWY/iIaM1scQdVd/hueGTfd3euFopMCM4C8T+AXQuvSPNuIxLcm2OXmjzIYMBA0vDHxZEEXtPlSrmx/1+wx/Rq0r0IDX0zPcKtZPHyiv1fuL0Pd67EHDBv2OW+kufQsg9K1pN8cJikO3a/ZjeO4O9oZXXs6X3PeTdDdMQ+mJMLh8DaRJMyr39hKme64kbGUJXFJAFo8HE4U3KL4i9zEV9FK/vOXLeY5qKZd/07jzXAdiGCyzz1FSExPY6dgIcMwQzSovxTCu+aA21wmF6YYjuWNwUyuRCLSH2WDIODXcs9SJip48Uh0tvsTLhlQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, Mar 17, 2025 at 10:43:38AM +0100, Przemek Kitszel wrote: > On 3/17/25 10:26, Przemek Kitszel wrote: > > On 3/15/25 04:15, Kees Cook wrote: > > > Introduce __flex_counter() which wraps __builtin_counted_by_ref(), > > > as newly introduced by GCC[1] and Clang[2]. Use of __flex_counter() > > > allows access to the counter member of a struct's flexible array member > > > when it has been annotated with __counted_by(). > > > > > > Introduce typeof_flex_counter(), can_set_flex_counter(), and > > > set_flex_counter() to provide the needed _Generic() wrappers to get sane > > > results out of __flex_counter(). > > > > > > For example, with: > > > > > >     struct foo { > > >         int counter; > > >         short array[] __counted_by(counter); > > >     } *p; > > > > > > __flex_counter(p->array) will resolve to: &p->counter > > > > > > typeof_flex_counter(p->array) will resolve to "int". (If p->array was not > > > annotated, it would resolve to "size_t".) > > > > > > can_set_flex_counter(p->array, COUNT) is the same as: > > > > > >     COUNT <= type_max(p->counter) && COUNT >= type_min(p->counter) > > > > > > (If p->array was not annotated it would return true since everything > > > fits in size_t.) > > > > > > set_flex_counter(p->array, COUNT) is the same as: > > > > > >     p->counter = COUNT; > > > > > > (It is a no-op if p->array is not annotated with __counted_by().) > > > > > > Signed-off-by: Kees Cook > > > > I agree that there is no suitable fallback handy, but I see counter > > as integral part of the struct (in contrast to being merely annotation), > > IOW, without set_flex_counter() doing the assignment, someone will > > reference it later anyway, without any warning when kzalloc()'d > > > > So, maybe BUILD_BUG() instead of no-op? > > I get that so far this is only used as an internal helper (in the next > patch), so for me it would be also fine to just add __ prefix: > __set_flex_counter(), at least until the following is true: > "manual initialization of the flexible array counter is still > required (at some point) after allocation as not all compiler versions > support the __counted_by annotation yet" Yeah, that's fair. I will rename set_... and can_set_... Thought FWIW I'm not sure we'll ever want a BUILD_BUG_ON() just because there will be flex arrays with future annotations that can't have their counter set (e.g. annotations that indicate globals, expressions, etc -- support for these cases is coming, if slowly[1]). -Kees [1] loooong thread https://gcc.gnu.org/pipermail/gcc-patches/2025-March/677024.html -- Kees Cook