netdev - Re: [PATCH v2] cleanup: adjust scoped_guard() to avoid potential warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZwaDRJBs82oFMbZ8@smile.fi.intel.com>
Date: Wed, 9 Oct 2024 16:21:08 +0300
From: Andy Shevchenko <andriy.shevchenko@...el.com>
To: Przemek Kitszel <przemyslaw.kitszel@...el.com>
Cc: linux-kernel@...r.kernel.org, Peter Zijlstra <peterz@...radead.org>,
	amadeuszx.slawinski@...ux.intel.com,
	Tony Nguyen <anthony.l.nguyen@...el.com>,
	nex.sw.ncis.osdt.itp.upstreaming@...el.com, netdev@...r.kernel.org,
	Markus Elfring <Markus.Elfring@....de>,
	Dan Carpenter <dan.carpenter@...aro.org>,
	Dmitry Torokhov <dmitry.torokhov@...il.com>
Subject: Re: [PATCH v2] cleanup: adjust scoped_guard() to avoid potential
 warning

On Wed, Oct 09, 2024 at 01:44:17PM +0200, Przemek Kitszel wrote:
> Change scoped_guard() to make reasoning about it easier for static
> analysis tools (smatch, compiler diagnostics), especially to enable them
> to tell if the given scoped_guard() is conditional (interruptible-locks,
> try-locks) or not (like simple mutex_lock()).
> 
> Add compile-time error if scoped_cond_guard() is used for non-conditional
> lock class.
> 
> Beyond easier tooling and a little shrink reported by bloat-o-meter:
> add/remove: 3/2 grow/shrink: 45/55 up/down: 1573/-2069 (-496)
> this patch enables developer to write code like:
> 
> int foo(struct my_drv *adapter)
> {
> 	scoped_guard(spinlock, &adapter->some_spinlock)
> 		return adapter->spinlock_protected_var;
> }
> 
> Current scoped_guard() implementation does not support that,
> due to compiler complaining:
> error: control reaches end of non-void function [-Werror=return-type]
> 
> Technical stuff about the change:
> scoped_guard() macro uses common idiom of using "for" statement to declare
> a scoped variable. Unfortunately, current logic is too hard for compiler
> diagnostics to be sure that there is exactly one loop step; fix that.
> 
> To make any loop so trivial that there is no above warning, it must not
> depend on any non-const variable to tell if there are more steps. There is
> no obvious solution for that in C, but one could use the compound
> statement expression with "goto" jumping past the "loop", effectively
> leaving only the subscope part of the loop semantics.
> 
> More impl details:
> one more level of macro indirection is now needed to avoid duplicating
> label names;
> I didn't spot any other place that is using the
> "for (...; goto label) if (0) label: break;" idiom, so it's not packed
> for reuse, what makes actual macros code cleaner.
> 
> There was also a need to introduce const true/false variable per lock
> class, it is used to aid compiler diagnostics reasoning about "exactly
> 1 step" loops (note that converting that to function would undo the whole
> benefit).
> 
> Big thanks to Andy Shevchenko for help on this patch, both internal and
> public, ranging from whitespace/formatting, through commit message
> clarifications, general improvements, ending with presenting alternative
> approaches - all despite not even liking the idea.
> 
> Big thanks to Dmitry Torokhov for the idea of compile-time check for
> scoped_cond_guard(), and general improvements for the patch.

...

> @@ -149,14 +149,21 @@ static inline class_##_name##_t class_##_name##ext##_constructor(_init_args) \
>   *      similar to scoped_guard(), except it does fail when the lock
>   *      acquire fails.
>   *
> + *	Only for conditional locks.

> + *

Slipped redundant blank line.

>   */

...

> +/* helper for the scoped_guard() macro

 /*
  * This is wrong style of the comment block, it's not network
  * related code where it's acceptable. Also, respect English,
  * i.e. capitalisation and punctuation in the sentences.
  */

> + *
> + * Note that the "!__is_cond_ptr(_name)" part of the condition ensures
> + * that compiler would be sure that for unconditional locks the body of
> + * the loop could not be skipped; it is needed because the other
> + * part - "__guard_ptr(_name)(&scope)" - is too hard to deduce (even if
> + * could be proven true for unconditional locks).
> + */

-- 
With Best Regards,
Andy Shevchenko