linux-hardening - Re: [PATCH v2] docs: Explain the desired position of function attributes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 30 Sep 2021 15:52:23 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Randy Dunlap <rdunlap@...radead.org>
Cc:     Jonathan Corbet <corbet@....net>, Joe Perches <joe@...ches.com>,
        Alexey Dobriyan <adobriyan@...il.com>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Rasmus Villemoes <linux@...musvillemoes.dk>,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-kernel@...r.kernel.org, linux-doc@...r.kernel.org,
        linux-hardening@...r.kernel.org
Subject: Re: [PATCH v2] docs: Explain the desired position of function
 attributes

On Thu, Sep 30, 2021 at 01:11:34PM -0700, Randy Dunlap wrote:
> On 9/30/21 12:24 PM, Kees Cook wrote:
> > While discussing how to format the addition of various function
> > attributes, some "unwritten rules" of ordering surfaced[1]. Capture as
> > close as possible to Linus's preferences for future reference.
> > 
> > (Though I note the dissent voiced by Joe Perches, Alexey Dobriyan, and
> > others that would prefer all attributes live on a separate leading line.)
> > 
> > [1] https://lore.kernel.org/mm-commits/CAHk-=wiOCLRny5aifWNhr621kYrJwhfURsa0vFPeUEm8mF0ufg@mail.gmail.com/
> > 
> > Signed-off-by: Kees Cook <keescook@...omium.org>
> > ---
> >   Documentation/process/coding-style.rst | 30 ++++++++++++++++++++++++++
> >   1 file changed, 30 insertions(+)
> > 
> > diff --git a/Documentation/process/coding-style.rst b/Documentation/process/coding-style.rst
> > index 42969ab37b34..6b4feb1c71e7 100644
> > --- a/Documentation/process/coding-style.rst
> > +++ b/Documentation/process/coding-style.rst
> > @@ -487,6 +487,36 @@ because it is a simple way to add valuable information for the reader.
> >   Do not use the ``extern`` keyword with function prototypes as this makes
> >   lines longer and isn't strictly necessary.
> > +When writing a function declarations, please keep the `order of elements regular
> > +<https://lore.kernel.org/mm-commits/CAHk-=wiOCLRny5aifWNhr621kYrJwhfURsa0vFPeUEm8mF0ufg@mail.gmail.com/>`_.
> > +For example::
> > +
> > + extern __init void * __must_check void action(enum magic value, size_t size,
> 
> Drop that second "void" ?  or what does it mean?
> Can __must_check and void be used together?

Gah, thanks. Fixed now in v3.

> 
> > + 	u8 count, char *fmt, ...) __printf(4, 5) __malloc;
> > +
> > +The preferred order of elements for a function prototype is:
> > +
> > +- storage class (here, ``extern``, and things like ``static __always_inline`` even though
> > +  ``__always_inline`` is technically an attribute, it is treated like ``inline``)
> > +- storage class attributes (here, ``__init`` -- i.e. section declarations, but also things like ``__cold``)
> > +- return type (here, ``void *``)
> > +- return type attributes (here, ``__must_check``)
> 
> I'm not trying to get you to change this, but I would prefer to see
> 
> extern __init __must_check void *action(...) <attributes>;
> 
> i.e., with the return type adjacent to the function name.

I have read and re-read Linus's emails, and did a frequency count in the
kernel, and it looks like the preference is [return type] [return type attrs]
but I personally agree with you. :)

# regex I built from __must_check hits...
$ re='((struct .*|void|char) \* ?|((unsigned )?(long|int)|bool|size_t)($| ))'

# type before __must_check
$ git grep -E "$re"'__must_check' | wc -l
746

# type after __must_check
$ git grep -E '\b(static (__always_)?inline )?__must_check($| '"$re"')' | wc -l
297

# type split(!) across __must_check or otherwise weird...
$ git grep -E '\b__must_check\b' | grep -Ev '\b(static (__always_)?inline )?__must_check($| '"$re"')' | grep -Ev "$re"'__must_check\b' | wc -l
44


-- 
Kees Cook