Messages in this thread | | | Subject | Re: [PATCH 1/5] Compiler Attributes: Add __alloc_size() for better bounds checking | From | Nathan Chancellor <> | Date | Wed, 18 Aug 2021 11:04:32 -0700 |
| |
On 8/17/2021 10:08 PM, Kees Cook wrote: > GCC and Clang can use the alloc_size attribute to better inform the > results of __builtin_object_size() (for compile-time constant values). > Clang can additionally use alloc_size to informt the results of > __builtin_dynamic_object_size() (for run-time values). > > Additionally disables -Wno-alloc-size-larger-than since the allocators > already reject SIZE_MAX, and the compile-time warnings aren't helpful.
In addition to what Miguel said, it might be helpful to mention that this warning is GCC specific, I was a little confused at first as to why it was just being added in the GCC only block :)
Otherwise, the attribute addition looks good to me. I will add my tag on v2.
> Cc: Miguel Ojeda <ojeda@kernel.org> > Cc: Nathan Chancellor <nathan@kernel.org> > Cc: Nick Desaulniers <ndesaulniers@google.com> > Cc: clang-built-linux@googlegroups.com > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > Makefile | 6 +++++- > include/linux/compiler_attributes.h | 6 ++++++ > 2 files changed, 11 insertions(+), 1 deletion(-) > > diff --git a/Makefile b/Makefile > index 1b238ce86ed4..3b6fb740584e 100644 > --- a/Makefile > +++ b/Makefile > @@ -1076,9 +1076,13 @@ KBUILD_CFLAGS += $(call cc-disable-warning, stringop-overflow) > # Another good warning that we'll want to enable eventually > KBUILD_CFLAGS += $(call cc-disable-warning, restrict) > > -# Enabled with W=2, disabled by default as noisy > ifdef CONFIG_CC_IS_GCC > +# Enabled with W=2, disabled by default as noisy > KBUILD_CFLAGS += -Wno-maybe-uninitialized > + > +# The allocators already balk at large sizes, so silence the compiler > +# warnings for bounds checks involving those possible values. > +KBUILD_CFLAGS += -Wno-alloc-size-larger-than > endif > > # disable invalid "can't wrap" optimizations for signed / pointers > diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h > index 67c5667f8042..203b0ac62d15 100644 > --- a/include/linux/compiler_attributes.h > +++ b/include/linux/compiler_attributes.h > @@ -54,6 +54,12 @@ > #define __aligned(x) __attribute__((__aligned__(x))) > #define __aligned_largest __attribute__((__aligned__)) > > +/* > + * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-alloc_005fsize-function-attribute > + * clang: https://clang.llvm.org/docs/AttributeReference.html#alloc-size > + */ > +#define __alloc_size(x, ...) __attribute__((__alloc_size__(x, ## __VA_ARGS__))) > + > /* > * Note: users of __always_inline currently do not write "inline" themselves, > * which seems to be required by gcc to apply the attribute according >
| |