linux-kernel - [PATCH RFC 04/33] include/linux/cleanup.h: Support thread-safety analysis

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250206175114.1974171-5-bvanassche@acm.org>
Date: Thu,  6 Feb 2025 09:50:45 -0800
From: Bart Van Assche <bvanassche@....org>
To: Peter Zijlstra <peterz@...radead.org>
Cc: Will Deacon <will@...nel.org>,
	Christoph Hellwig <hch@....de>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Marco Elver <elver@...gle.com>,
	Nick Desaulniers <ndesaulniers@...gle.com>,
	Nathan Chancellor <nathan@...nel.org>,
	Kees Cook <kees@...nel.org>,
	Jann Horn <jannh@...gle.com>,
	linux-kernel@...r.kernel.org,
	Bart Van Assche <bvanassche@....org>
Subject: [PATCH RFC 04/33] include/linux/cleanup.h: Support thread-safety analysis

Introduce variants of the DEFINE_CLASS(), DEFINE_GUARD() and
DEFINE_GUARD_COND() macros that support passing function attributes for the
constructor functions.

Suppress thread-safety analysis for free functions because some free
functions change the state of synchronization objects. An example from
net/core/dev.h:

DEFINE_FREE(netdev_unlock, struct net_device *, if (_T) netdev_unlock(_T));

Co-developed-by: Marco Elver <elver@...gle.com>
Signed-off-by: Bart Van Assche <bvanassche@....org>
---
 include/linux/cleanup.h | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/include/linux/cleanup.h b/include/linux/cleanup.h
index ec00e3f7af2b..f6a42cac81c6 100644
--- a/include/linux/cleanup.h
+++ b/include/linux/cleanup.h
@@ -3,6 +3,7 @@
 #define _LINUX_CLEANUP_H
 
 #include <linux/compiler.h>
+#include <linux/thread_safety.h>
 
 /**
  * DOC: scope-based cleanup helpers
@@ -195,7 +196,8 @@
  */
 
 #define DEFINE_FREE(_name, _type, _free) \
-	static inline void __free_##_name(void *p) { _type _T = *(_type *)p; _free; }
+	static inline void __free_##_name(void *p) NO_THREAD_SAFETY_ANALYSIS \
+	{ _type _T = *(_type *)p; _free; }
 
 #define __free(_name)	__cleanup(__free_##_name)
 
@@ -241,17 +243,25 @@ const volatile void * __must_check_fn(const volatile void *val)
  */
 
 #define DEFINE_CLASS(_name, _type, _exit, _init, _init_args...)		\
+	DEFINE_CLASS_ATTR(_name, _type, _exit,				\
+			  _init, NO_THREAD_SAFETY_ANALYSIS, _init_args)
+
+#define DEFINE_CLASS_ATTR(_name, _type, _exit, _init, _init_attr,	\
+			  _init_args...)				\
 typedef _type class_##_name##_t;					\
 static inline void class_##_name##_destructor(_type *p)			\
+	NO_THREAD_SAFETY_ANALYSIS					\
 { _type _T = *p; _exit; }						\
-static inline _type class_##_name##_constructor(_init_args)		\
+static inline _type class_##_name##_constructor(_init_args) _init_attr	\
 { _type t = _init; return t; }
 
-#define EXTEND_CLASS(_name, ext, _init, _init_args...)			\
+#define EXTEND_CLASS(_name, ext, _init, _init_attr, _init_args...)	\
 typedef class_##_name##_t class_##_name##ext##_t;			\
 static inline void class_##_name##ext##_destructor(class_##_name##_t *p)\
+	NO_THREAD_SAFETY_ANALYSIS					\
 { class_##_name##_destructor(p); }					\
 static inline class_##_name##_t class_##_name##ext##_constructor(_init_args) \
+	_init_attr							\
 { class_##_name##_t t = _init; return t; }
 
 #define CLASS(_name, var)						\
@@ -291,17 +301,25 @@ static inline class_##_name##_t class_##_name##ext##_constructor(_init_args) \
 #define __DEFINE_CLASS_IS_CONDITIONAL(_name, _is_cond)	\
 static __maybe_unused const bool class_##_name##_is_conditional = _is_cond
 
-#define DEFINE_GUARD(_name, _type, _lock, _unlock) \
-	__DEFINE_CLASS_IS_CONDITIONAL(_name, false); \
-	DEFINE_CLASS(_name, _type, if (_T) { _unlock; }, ({ _lock; _T; }), _type _T); \
+#define DEFINE_GUARD(_name, _type, _lock, _unlock)			\
+	DEFINE_GUARD_ATTR(_name, _type, _lock, NO_THREAD_SAFETY_ANALYSIS,\
+			  _unlock)
+
+#define DEFINE_GUARD_ATTR(_name, _type, _lock, _lock_attr, _unlock)	\
+	__DEFINE_CLASS_IS_CONDITIONAL(_name, false);			\
+	DEFINE_CLASS_ATTR(_name, _type, if (_T) { _unlock; },		\
+		     ({ _lock; _T; }), _lock_attr, _type _T);		\
 	static inline void * class_##_name##_lock_ptr(class_##_name##_t *_T) \
 	{ return (void *)(__force unsigned long)*_T; }
 
 #define DEFINE_GUARD_COND(_name, _ext, _condlock) \
+	DEFINE_GUARD_COND_ATTR(_name, _ext, _condlock, )
+
+#define DEFINE_GUARD_COND_ATTR(_name, _ext, _condlock, _condlock_attr)	  \
 	__DEFINE_CLASS_IS_CONDITIONAL(_name##_ext, true); \
 	EXTEND_CLASS(_name, _ext, \
 		     ({ void *_t = _T; if (_T && !(_condlock)) _t = NULL; _t; }), \
-		     class_##_name##_t _T) \
+		     _condlock_attr, class_##_name##_t _T)		\
 	static inline void * class_##_name##_ext##_lock_ptr(class_##_name##_t *_T) \
 	{ return class_##_name##_lock_ptr(_T); }
 
@@ -413,7 +431,7 @@ __DEFINE_LOCK_GUARD_0(_name, _lock)
 	EXTEND_CLASS(_name, _ext,					\
 		     ({ class_##_name##_t _t = { .lock = l }, *_T = &_t;\
 		        if (_T->lock && !(_condlock)) _T->lock = NULL;	\
-			_t; }),						\
+			_t; }),	,					\
 		     typeof_member(class_##_name##_t, lock) l)		\
 	static inline void * class_##_name##_ext##_lock_ptr(class_##_name##_t *_T) \
 	{ return class_##_name##_lock_ptr(_T); }