From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2840C433F5 for ; Fri, 10 Sep 2021 17:24:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 992786120E for ; Fri, 10 Sep 2021 17:24:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230227AbhIJRZX (ORCPT ); Fri, 10 Sep 2021 13:25:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40664 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229664AbhIJRZW (ORCPT ); Fri, 10 Sep 2021 13:25:22 -0400 Received: from mail-lj1-x22d.google.com (mail-lj1-x22d.google.com [IPv6:2a00:1450:4864:20::22d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 211F6C061574 for ; Fri, 10 Sep 2021 10:24:11 -0700 (PDT) Received: by mail-lj1-x22d.google.com with SMTP id m4so4354950ljq.8 for ; Fri, 10 Sep 2021 10:24:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cypChv/ZPiPPdnrzU87mN4Ofl9d96gkwlfzVA4NlYRI=; b=J/bQOCMoNtLuqW1QBFpH98vDNeU4z7eQMVuPv+gzD0eb/B0ZmfYgKYurss1AMLET2j ZfqLEb20lguxzxEeNXsA5k/K/NNjUAmmcWmOBzDyNrsfAvq3rLtxFxCABcuBCZ6StP+6 iWWPm5KB/AEgaz9NOFyOYsUpcxuR00kIdIe44= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cypChv/ZPiPPdnrzU87mN4Ofl9d96gkwlfzVA4NlYRI=; b=PzNiU+pXm8oilZBPXRpRaEeCjbQMwXLWD7xttUsXjcXXFtCkj4Zyu3HHMsXVSl5gMk RTax27aQF62TbvN5XTOdvPVwowTnoG59xIbZ5CKQveVZqpqp3xZh5XAciwqoLeasPdKm iVlnKmM+H1Zn/nj1R5cq36JNaYKQtSppDrKJAlRDp8ucA7BZ7tj+yAB6Zg5fJe/vSDki Gxs9vOZHYhuLRGAnOJcGS4ScmGE9/YMlewZEHWi6DFSjIBBoN7UCX4OcC+7seg/8D926 N32Uw/O2Y0WDxeUfFjNA+5Sf9e1+557mZfemHrynFM5s2xZYOiqmXQYjEzuUm5cEqFUL koiA== X-Gm-Message-State: AOAM531FiJx/lSghSjI32y5h3DYaoHPy1Lcr8C0ii9BJvA20xoJUQMAN HUgwRVSw2m6dWbIAuos0hlBltLBgKjpsrEm1 X-Google-Smtp-Source: ABdhPJwG35X46CI7fDiL+idl8MgcS8bgXCceA4g96NmZiV9/X4RDOlMXxuhXf4NLxrTvs747y8YAoA== X-Received: by 2002:a2e:bf03:: with SMTP id c3mr4894528ljr.513.1631294648785; Fri, 10 Sep 2021 10:24:08 -0700 (PDT) Received: from mail-lf1-f41.google.com (mail-lf1-f41.google.com. [209.85.167.41]) by smtp.gmail.com with ESMTPSA id q17sm614804lfo.232.2021.09.10.10.24.04 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 10 Sep 2021 10:24:05 -0700 (PDT) Received: by mail-lf1-f41.google.com with SMTP id h16so5470436lfk.10 for ; Fri, 10 Sep 2021 10:24:04 -0700 (PDT) X-Received: by 2002:a05:6512:114c:: with SMTP id m12mr4883348lfg.150.1631294644229; Fri, 10 Sep 2021 10:24:04 -0700 (PDT) MIME-Version: 1.0 References: <20210909200948.090d4e213ca34b5ad1325a7e@linux-foundation.org> <20210910031046.G76dQvPhV%akpm@linux-foundation.org> In-Reply-To: <20210910031046.G76dQvPhV%akpm@linux-foundation.org> From: Linus Torvalds Date: Fri, 10 Sep 2021 10:23:48 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [patch 9/9] mm/vmalloc: add __alloc_size attributes for better bounds checking To: Andrew Morton Cc: apw@canonical.com, Christoph Lameter , Daniel Micay , Dennis Zhou , dwaipayanray1@gmail.com, Joonsoo Kim , Joe Perches , Kees Cook , Linux-MM , Lukas Bulwahn , mm-commits@vger.kernel.org, Nathan Chancellor , Nick Desaulniers , Miguel Ojeda , Pekka Enberg , David Rientjes , Tejun Heo , Vlastimil Babka Content-Type: text/plain; charset="UTF-8" Precedence: bulk Reply-To: linux-kernel@vger.kernel.org List-ID: X-Mailing-List: mm-commits@vger.kernel.org On Thu, Sep 9, 2021 at 8:10 PM Andrew Morton wrote: > > +__alloc_size(1) > extern void *vmalloc(unsigned long size); [...] All of these are added in the wrong place - inconsistent with the very compiler documentation the patches add. The function attributes are generally added _after_ the function, although admittedly we've been quite confused here before. But the very compiler documentation you point to in the patch that adds these macros gives that as the examples both for gcc and clang: + * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-alloc_005fsize-function-attribute + * clang: https://clang.llvm.org/docs/AttributeReference.html#alloc-size and honestly I think that is the preferred format because this is about the *function*, not about the return type. Do both placements work? Yes. Have we been confused about this before? Yes. I note that our __printf attributes in particular have been added in odd places. And our existing __malloc annotations seem to correct in and but then randomly applied in some other places. I really think it's pointlessly stupid and hard to read/grep for to make it be a separate line before the whole thing. I also think it should have taken over the "__malloc" name that is almost unused right now. Because why would you ever have __alloc_size() without having __malloc(). So wouldn't this all have looked much more natural as void *vmalloc(unsigned long size) __malloc(1); instead? Hmm? Linus From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25E29C433F5 for ; Fri, 10 Sep 2021 17:29:32 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 9B40C611CB for ; Fri, 10 Sep 2021 17:29:31 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 9B40C611CB Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 2FE586B0072; Fri, 10 Sep 2021 13:29:31 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2AD5D940007; Fri, 10 Sep 2021 13:29:31 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 14D5B6B0074; Fri, 10 Sep 2021 13:29:31 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0094.hostedemail.com [216.40.44.94]) by kanga.kvack.org (Postfix) with ESMTP id 032BD6B0072 for ; Fri, 10 Sep 2021 13:29:31 -0400 (EDT) Received: from smtpin06.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id A40308249980 for ; Fri, 10 Sep 2021 17:29:30 +0000 (UTC) X-FDA: 78572350500.06.7F9112F Received: from mail-lf1-f54.google.com (mail-lf1-f54.google.com [209.85.167.54]) by imf09.hostedemail.com (Postfix) with ESMTP id 52C683000108 for ; Fri, 10 Sep 2021 17:29:30 +0000 (UTC) Received: by mail-lf1-f54.google.com with SMTP id l11so5552043lfe.1 for ; Fri, 10 Sep 2021 10:29:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cypChv/ZPiPPdnrzU87mN4Ofl9d96gkwlfzVA4NlYRI=; b=J/bQOCMoNtLuqW1QBFpH98vDNeU4z7eQMVuPv+gzD0eb/B0ZmfYgKYurss1AMLET2j ZfqLEb20lguxzxEeNXsA5k/K/NNjUAmmcWmOBzDyNrsfAvq3rLtxFxCABcuBCZ6StP+6 iWWPm5KB/AEgaz9NOFyOYsUpcxuR00kIdIe44= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cypChv/ZPiPPdnrzU87mN4Ofl9d96gkwlfzVA4NlYRI=; b=OWd1N28jZFzSJnG5+3ZCrwuSrAbdIuCe2PWtv6/MsSpFqMfqoEjy7KongqiUSEekoT 1oRG4klvv+uql4oldk/aWW7t61FbkOd88FuCiUnPfERqkSKheg760ywvIC1CXyYDYubv gOTbSPaI6N7gPpL+3xESXqvLegnUxcSqQJ9a895Y2WIEE6lAxSjxjj7Gfzxxh8ig807e T5dcnvi1pzcV9G5nZiFiu/hdH4SHu13mVfcPpZznglYNZc9YBzGzuHT9tBdmtFd4P91Q UnN4XKI7QN0osPjf1wP25Q5cT1+BDg5YOhapuIOzT7J8MxuE110nqHtscTjCzN7fQGDi vVdg== X-Gm-Message-State: AOAM533P95NqLGhuBhFnTFFvcpn/5mUERm6PBOJk16hB6V1t5mXR+7Hk SbP0fh9jCC+J+Ul/Ze+BaHs6IoOyiDghPnMC9pU= X-Google-Smtp-Source: ABdhPJzqVGp2ykMD9RWfwd9BbMTV7XuCFPmaySdoSppSdGbk1eq9Z6XuA+QwEd5Hdnp5fzVb382Yww== X-Received: by 2002:a05:6512:a84:: with SMTP id m4mr4720642lfu.574.1631294968524; Fri, 10 Sep 2021 10:29:28 -0700 (PDT) Received: from mail-lj1-f182.google.com (mail-lj1-f182.google.com. [209.85.208.182]) by smtp.gmail.com with ESMTPSA id b15sm643039ljj.16.2021.09.10.10.29.27 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 10 Sep 2021 10:29:28 -0700 (PDT) Received: by mail-lj1-f182.google.com with SMTP id i28so4368920ljm.7 for ; Fri, 10 Sep 2021 10:29:27 -0700 (PDT) X-Received: by 2002:a05:6512:114c:: with SMTP id m12mr4883348lfg.150.1631294644229; Fri, 10 Sep 2021 10:24:04 -0700 (PDT) MIME-Version: 1.0 References: <20210909200948.090d4e213ca34b5ad1325a7e@linux-foundation.org> <20210910031046.G76dQvPhV%akpm@linux-foundation.org> In-Reply-To: <20210910031046.G76dQvPhV%akpm@linux-foundation.org> From: Linus Torvalds Date: Fri, 10 Sep 2021 10:23:48 -0700 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [patch 9/9] mm/vmalloc: add __alloc_size attributes for better bounds checking To: Andrew Morton Cc: apw@canonical.com, Christoph Lameter , Daniel Micay , Dennis Zhou , dwaipayanray1@gmail.com, Joonsoo Kim , Joe Perches , Kees Cook , Linux-MM , Lukas Bulwahn , mm-commits@vger.kernel.org, Nathan Chancellor , Nick Desaulniers , Miguel Ojeda , Pekka Enberg , David Rientjes , Tejun Heo , Vlastimil Babka Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 52C683000108 X-Stat-Signature: 4hzuxtxmtp79snhxx3dk45yxzwr5zfha Authentication-Results: imf09.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=google header.b="J/bQOCMo"; spf=pass (imf09.hostedemail.com: domain of torvalds@linuxfoundation.org designates 209.85.167.54 as permitted sender) smtp.mailfrom=torvalds@linuxfoundation.org; dmarc=none X-HE-Tag: 1631294970-428375 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Sep 9, 2021 at 8:10 PM Andrew Morton wrote: > > +__alloc_size(1) > extern void *vmalloc(unsigned long size); [...] All of these are added in the wrong place - inconsistent with the very compiler documentation the patches add. The function attributes are generally added _after_ the function, although admittedly we've been quite confused here before. But the very compiler documentation you point to in the patch that adds these macros gives that as the examples both for gcc and clang: + * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-alloc_005fsize-function-attribute + * clang: https://clang.llvm.org/docs/AttributeReference.html#alloc-size and honestly I think that is the preferred format because this is about the *function*, not about the return type. Do both placements work? Yes. Have we been confused about this before? Yes. I note that our __printf attributes in particular have been added in odd places. And our existing __malloc annotations seem to correct in and but then randomly applied in some other places. I really think it's pointlessly stupid and hard to read/grep for to make it be a separate line before the whole thing. I also think it should have taken over the "__malloc" name that is almost unused right now. Because why would you ever have __alloc_size() without having __malloc(). So wouldn't this all have looked much more natural as void *vmalloc(unsigned long size) __malloc(1); instead? Hmm? Linus