linux-kernel - Re: [PATCH 2/2] include/linux/typecheck.h: Zero initialize dummy variables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250502020919.GB1744689@ax162>
Date: Thu, 1 May 2025 19:09:19 -0700
From: Nathan Chancellor <nathan@...nel.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
	Masahiro Yamada <masahiroy@...nel.org>,
	Nicolas Schier <nicolas.schier@...ux.dev>,
	Nick Desaulniers <nick.desaulniers+lkml@...il.com>,
	Bill Wendling <morbo@...gle.com>,
	Justin Stitt <justinstitt@...gle.com>, linux-kbuild@...r.kernel.org,
	linux-kernel@...r.kernel.org, llvm@...ts.linux.dev,
	patches@...ts.linux.dev, stable@...r.kernel.org,
	Linux Kernel Functional Testing <lkft@...aro.org>,
	Marcus Seyfarth <m.seyfarth@...il.com>,
	Al Viro <viro@...iv.linux.org.uk>
Subject: Re: [PATCH 2/2] include/linux/typecheck.h: Zero initialize dummy
 variables

On Thu, May 01, 2025 at 06:34:57PM -0700, Linus Torvalds wrote:
> On Thu, 1 May 2025 at 18:24, Nathan Chancellor <nathan@...nel.org> wrote:
> >
> > but '= {0}' appears to work: https://godbolt.org/z/x7eae5vex
> >
> > If using that instead upsets sparse still, then I can just abandon this
> > change and update the other patch to disable -Wdefault-const-init-unsafe
> > altogether (
> 
> The "= { 0 }" form makes sparse unhappy for a different reason:
> 
>        void *a = { 0 };
> 
> makes sparse (correctly) complain about the use of '0' for 'NULL'.
> 
>     warning: Using plain integer as NULL pointer
> 
> and gcc has also finally adopted that warning for braindamage:
> 
>     warning: zero as null pointer constant [-Wzero-as-null-pointer-constant]

> although it's not on by default (and apparently we've never enabled it
> for the kernel - although we really should).
> 
> sparse has complained about this since day one, because I personally
> find the "plain 0 as NULL" to be a complete BS mistake in the language
> (that came from avoiding a keyword, not from some "design" reason),
> and while it took C++ people three decades to figure that out, in the
> end they did indeed figure it out.

Yeah, that is all entirely reasonable. It does not really seem like
there is a clean way to deal with this with our matrix (aside from
something like a local __diag_push() sequence, which I understand you do
not like), so I will abandon this and just turn off the warning entirely
(unless folks have other ideas). I am not really sure we will miss it
because clang will still warn if the variable is used uninitialized
since -Wuninitialized is enabled in -Wall.

  $ cat test.c
  int main(void)
  {
      const int a, b;
      return a;
  }

  $ clang -fsyntax-only test.c
  test.c:3:15: warning: default initialization of an object of type 'const int' leaves the object uninitialized and is incompatible with C++ [-Wdefault-const-init-var-unsafe]
      3 |     const int a, b;
        |               ^
  test.c:3:18: warning: default initialization of an object of type 'const int' leaves the object uninitialized and is incompatible with C++ [-Wdefault-const-init-var-unsafe]
      3 |     const int a, b;
        |                  ^
  2 warnings generated.

  $ clang -fsyntax-only -Wuninitialized test.c
  test.c:3:15: warning: default initialization of an object of type 'const int' leaves the object uninitialized and is incompatible with C++ [-Wdefault-const-init-var-unsafe]
      3 |     const int a, b;
        |               ^
  test.c:3:18: warning: default initialization of an object of type 'const int' leaves the object uninitialized and is incompatible with C++ [-Wdefault-const-init-var-unsafe]
      3 |     const int a, b;
        |                  ^
  test.c:4:12: warning: variable 'a' is uninitialized when used here [-Wuninitialized]
      4 |     return a;
        |            ^
  test.c:3:16: note: initialize the variable 'a' to silence this warning
      3 |     const int a, b;
        |                ^
        |                 = 0
  3 warnings generated.

Cheers,
Nathan