linux-kernel - Re: [PATCH 1/3] compiler_types: Introduce __counted_by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251021095447.GL3245006@noisy.programming.kicks-ass.net>
Date: Tue, 21 Oct 2025 11:54:47 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: Kees Cook <kees@...nel.org>
Cc: Miguel Ojeda <ojeda@...nel.org>, Nathan Chancellor <nathan@...nel.org>,
	Nick Desaulniers <nick.desaulniers+lkml@...il.com>,
	Bill Wendling <morbo@...gle.com>,
	Justin Stitt <justinstitt@...gle.com>,
	Marco Elver <elver@...gle.com>,
	Przemek Kitszel <przemyslaw.kitszel@...el.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Masahiro Yamada <masahiroy@...nel.org>,
	Christophe Leroy <christophe.leroy@...roup.eu>,
	Johannes Weiner <hannes@...xchg.org>, llvm@...ts.linux.dev,
	Al Viro <viro@...iv.linux.org.uk>, Arnd Bergmann <arnd@...db.de>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
	Nicolas Schier <nicolas.schier@...ux.dev>,
	Shuah Khan <shuah@...nel.org>,
	"Gustavo A. R. Silva" <gustavoars@...nel.org>,
	Thomas Weißschuh <thomas.weissschuh@...utronix.de>,
	Tamir Duberstein <tamird@...il.com>,
	Michael Kelley <mhklinux@...look.com>,
	kernel test robot <lkp@...el.com>,
	Heiko Carstens <hca@...ux.ibm.com>, Uros Bizjak <ubizjak@...il.com>,
	Jan Hendrik Farr <kernel@...rr.cc>,
	Yafang Shao <laoar.shao@...il.com>,
	Marc Herbert <Marc.Herbert@...ux.intel.com>,
	Christopher Ferris <cferris@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	Alexander Lobakin <aleksander.lobakin@...el.com>,
	Paolo Abeni <pabeni@...hat.com>, Tejun Heo <tj@...nel.org>,
	Jeff Xu <jeffxu@...omium.org>,
	Michal Koutný <mkoutny@...e.com>,
	Shakeel Butt <shakeel.butt@...ux.dev>,
	Randy Dunlap <rdunlap@...radead.org>,
	Brian Gerst <brgerst@...il.com>, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org, linux-kbuild@...r.kernel.org,
	linux-kselftest@...r.kernel.org, linux-hardening@...r.kernel.org
Subject: Re: [PATCH 1/3] compiler_types: Introduce __counted_by_ptr()

On Mon, Oct 20, 2025 at 03:01:15PM -0700, Kees Cook wrote:
> Introduce __counted_by_ptr(), which works like __counted_by(), but for
> pointer struct members:
> 
> struct foo {
> 	int a, b, c;
> 	char *buffer __counted_by_ptr(bytes);
> 	short nr_bars;
> 	struct bar *bars __counted_by_ptr(nr_bars);
> 	size_t bytes;
> };
> 
> Since "counted_by" can only be applied to pointer members in very recent
> compiler versions, its application ends up needing to be distinct from
> flexible array "counted_by" annotations, hence a separate macro.
> 
> Unfortunately, this annotation cannot be used for "void *" members
> (since such a member is considered a pointer to an incomplete type,
> and neither Clang nor GCC developers could be convinced otherwise[1],
> even in the face of the GNU extension that "void *" has size "1 byte"
> for pointer arithmetic). For "void *" members, we must use the coming
> "sized_by" attribute.

So why do we need both __counted_by_ptr() and this __sized_by(), won't
one be good enough?

Also, given the existing __counted_by() is really only usable with
>=19.1.3 and we're now at 22-ish, do we really need two of these?

That is, I'm really hating the idea we need 3 different annotations for
what is effectively the same thing and feel we should try *really* hard
to make it 1.