linux-kernel - Re: [PATCH] kbuild: Enable GCC diagnostic context for value-tracking warnings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202511211030.87A256197A@keescook>
Date: Fri, 21 Nov 2025 10:32:09 -0800
From: Kees Cook <kees@...nel.org>
To: Miguel Ojeda <miguel.ojeda.sandonis@...il.com>
Cc: "Gustavo A . R . Silva" <gustavoars@...nel.org>,
	Nathan Chancellor <nathan@...nel.org>,
	Nicolas Schier <nicolas.schier@...ux.dev>,
	Masahiro Yamada <masahiroy@...nel.org>,
	Miguel Ojeda <ojeda@...nel.org>, linux-kbuild@...r.kernel.org,
	Thomas Weißschuh <thomas.weissschuh@...utronix.de>,
	Tamir Duberstein <tamird@...il.com>, linux-kernel@...r.kernel.org,
	linux-hardening@...r.kernel.org
Subject: Re: [PATCH] kbuild: Enable GCC diagnostic context for value-tracking
 warnings

On Thu, Nov 20, 2025 at 09:17:16AM +0100, Miguel Ojeda wrote:
> On Wed, Nov 19, 2025 at 11:44 PM Kees Cook <kees@...nel.org> wrote:
> >
> > Enable GCC 16's coming "-fdiagnostics-show-context=2" option[1] to
> > provide enhanced diagnostic information for value-tracking warnings, which
> > displays the control flow chain leading to the diagnostic. This covers our
> 
> > existing use of -Wrestrict and -Wstringop-overread, and gets us closer to
> > enabling -Warray-bounds, -Wstringop-overflow, and -Wstringop-truncation.
> 
> I am probably missing some context, but in what sense gets us closer?
> Do you mean it will make it easier to understand those when we enable
> them? i.e. we still can't enable them until the minimum is upgraded,
> right?

Right -- we've been tracking down -Warray-bounds warnings for several
years now and it has been quite difficult to determine which are "real"
and which are false positives. This option makes the "real" cases much
more obvious.

I will improve the commit log.

> Apart from that, it looks like a nice improvement on the output from
> the PR examples -- I didn't test it, but the patch itself looks fine
> of course:
> 
> Reviewed-by: Miguel Ojeda <ojeda@...nel.org>

Thanks!

-- 
Kees Cook