linux-hardening - Re: [PATCH v2][next] container_of: add container

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2025012947-hexagon-almighty-57b3@gregkh>
Date: Wed, 29 Jan 2025 09:04:04 +0100
From: Greg KH <gregkh@...uxfoundation.org>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: "Gustavo A. R. Silva" <gustavoars@...nel.org>,
	linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org
Subject: Re: [PATCH v2][next] container_of: add container_first() macro

On Wed, Jan 29, 2025 at 10:33:56AM +0300, Dan Carpenter wrote:
> On Wed, Jan 29, 2025 at 10:29:24AM +0300, Dan Carpenter wrote:
> > drivers/iommu/iommufd/iommufd_private.h
> >    243  static inline struct iommufd_ioas *iommufd_get_ioas(struct iommufd_ctx *ictx,
> >    244                                                      u32 id)
> >    245  {
> >    246          return container_of(iommufd_get_object(ictx, id,
> >    247                                                 IOMMUFD_OBJ_IOAS),
> >    248                              struct iommufd_ioas, obj);
> >    249  }
> > 
> > It's just a cast like you say, but it looks like pointer math.  It would
> > be more readable as container_of_first().
> 
> I left out the important bit...  iommufd_get_object() returns error pointers.
> It doesn't make sense to pass error pointers to container_of() unless the
> offset is zero.

Ick, agreed.  you should never be checking the return value of
container_of().  Shouldn't we somehow check for that?  Is there the
inverse of __must_check where we "just" want to use the value but never
compare it to anything?

> Smatch could check that the offset is zero, but Coccinelle can't.  There are
> a bunch of advantages to Coccinelle at times so this will improve the
> readability and make it easier for static checkers as well.

But I don't see how container_first() will do anything to help the above
type of code.  Gustavo, have any examples of what you need this for?

thanks,

greg k-h