linux-hardening - Re: [PATCH v4 1/2] compiler_types: Introduce __flex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <eb6e6198-dc42-4a63-8d0d-35f3061ff388@intel.com>
Date: Mon, 17 Mar 2025 10:26:30 +0100
From: Przemek Kitszel <przemyslaw.kitszel@...el.com>
To: Kees Cook <kees@...nel.org>
CC: Vlastimil Babka <vbabka@...e.cz>, Miguel Ojeda <ojeda@...nel.org>,
	"Gustavo A. R. Silva" <gustavoars@...nel.org>, Nathan Chancellor
	<nathan@...nel.org>, Peter Zijlstra <peterz@...radead.org>, Nick Desaulniers
	<nick.desaulniers+lkml@...il.com>, Marco Elver <elver@...gle.com>,
	<linux-hardening@...r.kernel.org>, Christoph Lameter <cl@...ux.com>, "Pekka
 Enberg" <penberg@...nel.org>, David Rientjes <rientjes@...gle.com>, "Joonsoo
 Kim" <iamjoonsoo.kim@....com>, Andrew Morton <akpm@...ux-foundation.org>,
	Roman Gushchin <roman.gushchin@...ux.dev>, Hyeonggon Yoo
	<42.hyeyoo@...il.com>, Bill Wendling <morbo@...gle.com>, Justin Stitt
	<justinstitt@...gle.com>, Jann Horn <jannh@...gle.com>, Linus Torvalds
	<torvalds@...ux-foundation.org>, Greg Kroah-Hartman
	<gregkh@...uxfoundation.org>, Sasha Levin <sashal@...nel.org>, "Jonathan
 Corbet" <corbet@....net>, Jakub Kicinski <kuba@...nel.org>, Yafang Shao
	<laoar.shao@...il.com>, Tony Ambardar <tony.ambardar@...il.com>, "Alexander
 Lobakin" <aleksander.lobakin@...el.com>, Jan Hendrik Farr <kernel@...rr.cc>,
	Alexander Potapenko <glider@...gle.com>, <linux-kernel@...r.kernel.org>,
	<linux-mm@...ck.org>, <linux-doc@...r.kernel.org>, <llvm@...ts.linux.dev>
Subject: Re: [PATCH v4 1/2] compiler_types: Introduce __flex_counter() and
 family

On 3/15/25 04:15, Kees Cook wrote:
> Introduce __flex_counter() which wraps __builtin_counted_by_ref(),
> as newly introduced by GCC[1] and Clang[2]. Use of __flex_counter()
> allows access to the counter member of a struct's flexible array member
> when it has been annotated with __counted_by().
> 
> Introduce typeof_flex_counter(), can_set_flex_counter(), and
> set_flex_counter() to provide the needed _Generic() wrappers to get sane
> results out of __flex_counter().
> 
> For example, with:
> 
> 	struct foo {
> 		int counter;
> 		short array[] __counted_by(counter);
> 	} *p;
> 
> __flex_counter(p->array) will resolve to: &p->counter
> 
> typeof_flex_counter(p->array) will resolve to "int". (If p->array was not
> annotated, it would resolve to "size_t".)
> 
> can_set_flex_counter(p->array, COUNT) is the same as:
> 
> 	COUNT <= type_max(p->counter) && COUNT >= type_min(p->counter)
> 
> (If p->array was not annotated it would return true since everything
> fits in size_t.)
> 
> set_flex_counter(p->array, COUNT) is the same as:
> 
> 	p->counter = COUNT;
> 
> (It is a no-op if p->array is not annotated with __counted_by().)
> 
> Signed-off-by: Kees Cook <kees@...nel.org>

I agree that there is no suitable fallback handy, but I see counter
as integral part of the struct (in contrast to being merely annotation),
IOW, without set_flex_counter() doing the assignment, someone will
reference it later anyway, without any warning when kzalloc()'d

So, maybe BUILD_BUG() instead of no-op?

> +#define set_flex_counter(FAM, COUNT)				\
> +({								\
> +	*_Generic(__flex_counter(FAM),				\
> +		  void *:  &(size_t){ 0 },			\
> +		  default: __flex_counter(FAM)) = (COUNT);	\
> +})
> +
>   #endif /* __LINUX_OVERFLOW_H */