| Message ID | 20210818050841.2226600-2-keescook@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Add __alloc_size() for better bounds checking | expand |
On Wed, Aug 18, 2021 at 7:08 AM Kees Cook <keescook@chromium.org> wrote: > > Clang can additionally use alloc_size to informt the results of Typo. > Additionally disables -Wno-alloc-size-larger-than since the allocators Disables -Walloc-size-larger-than? > already reject SIZE_MAX, and the compile-time warnings aren't helpful. Perhaps a bit more context here (and/or in the comment in the Makefile) would be nice: i.e. why are they not helpful (even if rejected by the allocators). Cheers, Miguel
On Wed, Aug 18, 2021 at 03:07:48PM +0200, Miguel Ojeda wrote: > On Wed, Aug 18, 2021 at 7:08 AM Kees Cook <keescook@chromium.org> wrote: > > > > Clang can additionally use alloc_size to informt the results of > > Typo. > > > Additionally disables -Wno-alloc-size-larger-than since the allocators > > Disables -Walloc-size-larger-than? > > > already reject SIZE_MAX, and the compile-time warnings aren't helpful. > > Perhaps a bit more context here (and/or in the comment in the > Makefile) would be nice: i.e. why are they not helpful (even if > rejected by the allocators). Thanks for the review! I'll get this all fixed for v2.
On 8/17/2021 10:08 PM, Kees Cook wrote: > GCC and Clang can use the alloc_size attribute to better inform the > results of __builtin_object_size() (for compile-time constant values). > Clang can additionally use alloc_size to informt the results of > __builtin_dynamic_object_size() (for run-time values). > > Additionally disables -Wno-alloc-size-larger-than since the allocators > already reject SIZE_MAX, and the compile-time warnings aren't helpful. In addition to what Miguel said, it might be helpful to mention that this warning is GCC specific, I was a little confused at first as to why it was just being added in the GCC only block :) Otherwise, the attribute addition looks good to me. I will add my tag on v2. > Cc: Miguel Ojeda <ojeda@kernel.org> > Cc: Nathan Chancellor <nathan@kernel.org> > Cc: Nick Desaulniers <ndesaulniers@google.com> > Cc: clang-built-linux@googlegroups.com > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > Makefile | 6 +++++- > include/linux/compiler_attributes.h | 6 ++++++ > 2 files changed, 11 insertions(+), 1 deletion(-) > > diff --git a/Makefile b/Makefile > index 1b238ce86ed4..3b6fb740584e 100644 > --- a/Makefile > +++ b/Makefile > @@ -1076,9 +1076,13 @@ KBUILD_CFLAGS += $(call cc-disable-warning, stringop-overflow) > # Another good warning that we'll want to enable eventually > KBUILD_CFLAGS += $(call cc-disable-warning, restrict) > > -# Enabled with W=2, disabled by default as noisy > ifdef CONFIG_CC_IS_GCC > +# Enabled with W=2, disabled by default as noisy > KBUILD_CFLAGS += -Wno-maybe-uninitialized > + > +# The allocators already balk at large sizes, so silence the compiler > +# warnings for bounds checks involving those possible values. > +KBUILD_CFLAGS += -Wno-alloc-size-larger-than > endif > > # disable invalid "can't wrap" optimizations for signed / pointers > diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h > index 67c5667f8042..203b0ac62d15 100644 > --- a/include/linux/compiler_attributes.h > +++ b/include/linux/compiler_attributes.h > @@ -54,6 +54,12 @@ > #define __aligned(x) __attribute__((__aligned__(x))) > #define __aligned_largest __attribute__((__aligned__)) > > +/* > + * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-alloc_005fsize-function-attribute > + * clang: https://clang.llvm.org/docs/AttributeReference.html#alloc-size > + */ > +#define __alloc_size(x, ...) __attribute__((__alloc_size__(x, ## __VA_ARGS__))) > + > /* > * Note: users of __always_inline currently do not write "inline" themselves, > * which seems to be required by gcc to apply the attribute according >
On Wed, Aug 18, 2021 at 11:04:32AM -0700, Nathan Chancellor wrote: > On 8/17/2021 10:08 PM, Kees Cook wrote: > > GCC and Clang can use the alloc_size attribute to better inform the > > results of __builtin_object_size() (for compile-time constant values). > > Clang can additionally use alloc_size to informt the results of > > __builtin_dynamic_object_size() (for run-time values). > > > > Additionally disables -Wno-alloc-size-larger-than since the allocators > > already reject SIZE_MAX, and the compile-time warnings aren't helpful. > > In addition to what Miguel said, it might be helpful to mention that this > warning is GCC specific, I was a little confused at first as to why it was > just being added in the GCC only block :) Yes, good point. I'll call it out in particular. > Otherwise, the attribute addition looks good to me. I will add my tag on v2. Thanks!
diff --git a/Makefile b/Makefile index 1b238ce86ed4..3b6fb740584e 100644 --- a/Makefile +++ b/Makefile @@ -1076,9 +1076,13 @@ KBUILD_CFLAGS += $(call cc-disable-warning, stringop-overflow) # Another good warning that we'll want to enable eventually KBUILD_CFLAGS += $(call cc-disable-warning, restrict) -# Enabled with W=2, disabled by default as noisy ifdef CONFIG_CC_IS_GCC +# Enabled with W=2, disabled by default as noisy KBUILD_CFLAGS += -Wno-maybe-uninitialized + +# The allocators already balk at large sizes, so silence the compiler +# warnings for bounds checks involving those possible values. +KBUILD_CFLAGS += -Wno-alloc-size-larger-than endif # disable invalid "can't wrap" optimizations for signed / pointers diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h index 67c5667f8042..203b0ac62d15 100644 --- a/include/linux/compiler_attributes.h +++ b/include/linux/compiler_attributes.h @@ -54,6 +54,12 @@ #define __aligned(x) __attribute__((__aligned__(x))) #define __aligned_largest __attribute__((__aligned__)) +/* + * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-alloc_005fsize-function-attribute + * clang: https://clang.llvm.org/docs/AttributeReference.html#alloc-size + */ +#define __alloc_size(x, ...) __attribute__((__alloc_size__(x, ## __VA_ARGS__))) + /* * Note: users of __always_inline currently do not write "inline" themselves, * which seems to be required by gcc to apply the attribute according
GCC and Clang can use the alloc_size attribute to better inform the results of __builtin_object_size() (for compile-time constant values). Clang can additionally use alloc_size to informt the results of __builtin_dynamic_object_size() (for run-time values). Additionally disables -Wno-alloc-size-larger-than since the allocators already reject SIZE_MAX, and the compile-time warnings aren't helpful. Cc: Miguel Ojeda <ojeda@kernel.org> Cc: Nathan Chancellor <nathan@kernel.org> Cc: Nick Desaulniers <ndesaulniers@google.com> Cc: clang-built-linux@googlegroups.com Signed-off-by: Kees Cook <keescook@chromium.org> --- Makefile | 6 +++++- include/linux/compiler_attributes.h | 6 ++++++ 2 files changed, 11 insertions(+), 1 deletion(-)