linux-kernel - Re: [PATCH] Makefile: Convert -Wimplicit-fallthrough=3 to just -Wimplicit-fallthrough for clang

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b27facb8d794c58353736f88a60c24f7b2c001d7.camel@perches.com>
Date:   Mon, 12 Aug 2019 10:42:28 -0700
From:   Joe Perches <joe@...ches.com>
To:     Nick Desaulniers <ndesaulniers@...gle.com>
Cc:     Nathan Chancellor <natechancellor@...il.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        "Gustavo A. R. Silva" <gustavo@...eddedor.com>,
        LKML <linux-kernel@...r.kernel.org>,
        clang-built-linux <clang-built-linux@...glegroups.com>
Subject: Re: [PATCH] Makefile: Convert -Wimplicit-fallthrough=3 to just
 -Wimplicit-fallthrough for clang

On Mon, 2019-08-12 at 09:28 -0700, Nick Desaulniers wrote:
> Isn't [[fallthrough]] the C++ style attribute?

double brackets will likely at some point become the default
attribute style for c as well.  It is not now though and
linux will continue to support gcc 7+ and the __attribute__
style for quite a while.

The minimum gcc version just moved to 4.6 which was
released in 2013 so likely linux won't move to something
that requires [[<attribute>]] for a decade or more.

> **eek** Seems to be a
> waste for Clang to implement __attribute__((fallthrough)) just as we
> switch the kernel to not use it.

clang already supports the __attribute__((<foo>)) style for
gcc compatibility.

This is just clang supporting a new <foo> type which would
nominally be required for gcc compatibility anyway.

> Also, I'd recommend making the
> preprocessor define all caps to help folks recognize it's a
> preprocessor define.

It's more a matching styles thing.

I rather suspect that the c committees would choose to add
fallthrough as a keyword if it was possible, but it is not
possible without risking breaking existing code.

linux source code is not constrained by this requirement.

In my opinion, case statement blocks should always use a
terminating keyword.  I think the best option is to add
fallthrough as a keyword, but there are other options:

IMO the best option is:
	break;; goto; return; fallthrough;
or (slightly worse)
	break; goto; return; __fallthrough;
or (even worse)
	break; goto; return; FALLTHROUGH;

Generic arguments pro/con for each style:
----------------------------------------
fallthrough looks like normal code but could not be
used in uapi headers.

__fallthrough is underscore prefixed, so reserved and
generic, and could be used in uapi headers.  __fallthrough
is rather unnatural looking when used to terminate a case
statement block.

FALLTHROUGH looks like a macro, but could not be used in
uapi headers.  It is also rather unnatural looking when
used to terminate a case statement block.
----------------------------------------

There are no existing uses of fallthrough in uapi headers.