linux-kernel - [PATCH 1/2] kbuild: Disable -Wdefault-const-init-field-unsafe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250501-default-const-init-clang-v1-1-3d2c6c185dbb@kernel.org>
Date: Thu, 01 May 2025 16:00:21 -0700
From: Nathan Chancellor <nathan@...nel.org>
To: Andrew Morton <akpm@...ux-foundation.org>, 
 Masahiro Yamada <masahiroy@...nel.org>
Cc: Nicolas Schier <nicolas.schier@...ux.dev>, 
 Andrew Morton <akpm@...ux-foundation.org>, 
 Nick Desaulniers <nick.desaulniers+lkml@...il.com>, 
 Bill Wendling <morbo@...gle.com>, Justin Stitt <justinstitt@...gle.com>, 
 Linus Torvalds <torvalds@...ux-foundation.org>, 
 linux-kbuild@...r.kernel.org, linux-kernel@...r.kernel.org, 
 llvm@...ts.linux.dev, patches@...ts.linux.dev, stable@...r.kernel.org, 
 Linux Kernel Functional Testing <lkft@...aro.org>, 
 Marcus Seyfarth <m.seyfarth@...il.com>, 
 Nathan Chancellor <nathan@...nel.org>
Subject: [PATCH 1/2] kbuild: Disable -Wdefault-const-init-field-unsafe

A new on by default warning in clang [1] flags several places within the
kernel where a const member of an aggregate type appears to be
uninitialized:

  include/linux/list.h:409:27: warning: default initialization of an object of type 'union (unnamed union at include/linux/list.h:409:27)' with const member leaves the object uninitialized and is incompatible with C++ [-Wdefault-const-init-field-unsafe]
    409 |         struct list_head *next = smp_load_acquire(&head->next);
        |                                  ^
  include/asm-generic/barrier.h:176:29: note: expanded from macro 'smp_load_acquire'
    176 | #define smp_load_acquire(p) __smp_load_acquire(p)
        |                             ^
  arch/arm64/include/asm/barrier.h:164:59: note: expanded from macro '__smp_load_acquire'
    164 |         union { __unqual_scalar_typeof(*p) __val; char __c[1]; } __u;   \
        |                                                                  ^
  include/linux/list.h:409:27: note: member '__val' declared 'const' here

  crypto/scatterwalk.c:66:22: error: default initialization of an object of type 'struct scatter_walk' with const member leaves the object uninitialized and is incompatible with C++ [-Werror,-Wdefault-const-init-field-unsafe]
     66 |         struct scatter_walk walk;
        |                             ^
  include/crypto/algapi.h:112:15: note: member 'addr' declared 'const' here
    112 |                 void *const addr;
        |                             ^

  fs/hugetlbfs/inode.c:733:24: error: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized and is incompatible with C++ [-Werror,-Wdefault-const-init-field-unsafe]
    733 |         struct vm_area_struct pseudo_vma;
        |                               ^
  include/linux/mm_types.h:803:20: note: member 'vm_flags' declared 'const' here
    803 |                 const vm_flags_t vm_flags;
        |                                  ^

In all audited cases, the members are either not used in the particular
call path, modified through other means such as memset() / memcpy()
because the containing object is not const, or are within a union with
other non-const members. Since these are technically false positives,
the warning was split out from its main group [2] to allow the kernel to
disable it while keeping the variable aspect of the warning enabled.

Cc: stable@...r.kernel.org
Link: https://github.com/llvm/llvm-project/commit/576161cb6069e2c7656a8ef530727a0f4aefff30 [1]
Link: https://github.com/llvm/llvm-project/commit/00f9ef282c7482754a0fea497417604d1deca9fa [2]
Reported-by: Linux Kernel Functional Testing <lkft@...aro.org>
Closes: https://lore.kernel.org/CA+G9fYuNjKcxFKS_MKPRuga32XbndkLGcY-PVuoSwzv6VWbY=w@mail.gmail.com/
Reported-by: Marcus Seyfarth <m.seyfarth@...il.com>
Closes: https://github.com/ClangBuiltLinux/linux/issues/2088
Signed-off-by: Nathan Chancellor <nathan@...nel.org>
---
 scripts/Makefile.extrawarn | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
index d88acdf4085524b672c69fb75148ee87c30f88d8..b4d8265e587082687bc1d3de3fcc70e4a3f4f50d 100644
--- a/scripts/Makefile.extrawarn
+++ b/scripts/Makefile.extrawarn
@@ -37,6 +37,13 @@ KBUILD_CFLAGS += -Wno-gnu
 # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111219
 KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow-non-kprintf)
 KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation-non-kprintf)
+
+# clang emits a warning when a const member of an aggregate type is not
+# initialized but there are several places in the kernel where this is
+# intentional because the field is never used within a particular call path,
+# the field is within a union with other non-const members, or the containing
+# object is not const so the field can be modified via memcpy() / memset().
+KBUILD_CFLAGS += $(call cc-disable-warning, default-const-init-field-unsafe)
 else
 
 # gcc inanely warns about local variables called 'main'

-- 
2.49.0