From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9FCB3C433EF for ; Wed, 2 Feb 2022 16:19:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345808AbiBBQT6 convert rfc822-to-8bit (ORCPT ); Wed, 2 Feb 2022 11:19:58 -0500 Received: from eu-smtp-delivery-151.mimecast.com ([185.58.86.151]:30841 "EHLO eu-smtp-delivery-151.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230078AbiBBQT5 (ORCPT ); Wed, 2 Feb 2022 11:19:57 -0500 Received: from AcuMS.aculab.com (156.67.243.121 [156.67.243.121]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id uk-mta-33-SGQvv5ccMsmU2w2G6u_tRw-1; Wed, 02 Feb 2022 16:19:55 +0000 X-MC-Unique: SGQvv5ccMsmU2w2G6u_tRw-1 Received: from AcuMS.Aculab.com (fd9f:af1c:a25b:0:994c:f5c2:35d6:9b65) by AcuMS.aculab.com (fd9f:af1c:a25b:0:994c:f5c2:35d6:9b65) with Microsoft SMTP Server (TLS) id 15.0.1497.28; Wed, 2 Feb 2022 16:19:52 +0000 Received: from AcuMS.Aculab.com ([fe80::994c:f5c2:35d6:9b65]) by AcuMS.aculab.com ([fe80::994c:f5c2:35d6:9b65%12]) with mapi id 15.00.1497.028; Wed, 2 Feb 2022 16:19:52 +0000 From: David Laight To: 'Kees Cook' , Jonathan Corbet CC: Linus Torvalds , Martin Uecker , Ingo Molnar , Miguel Ojeda , Rikard Falkeborn , Arnd Bergmann , "linux-doc@vger.kernel.org" , Tetsuo Handa , Andrew Morton , Andy Shevchenko , Nick Desaulniers , "Gustavo A. R. Silva" , "linux-kernel@vger.kernel.org" , "linux-hardening@vger.kernel.org" Subject: RE: [PATCH] linux/const.h: Explain how __is_constexpr() works Thread-Topic: [PATCH] linux/const.h: Explain how __is_constexpr() works Thread-Index: AQHYFuNHRL4oDGFcTkyEh79ubpGBJ6yAbZqw Date: Wed, 2 Feb 2022 16:19:52 +0000 Message-ID: <6641e01b86374ce197020d57c65ae3b3@AcuMS.aculab.com> References: <20220131204357.1133674-1-keescook@chromium.org> In-Reply-To: <20220131204357.1133674-1-keescook@chromium.org> Accept-Language: en-GB, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.202.205.107] MIME-Version: 1.0 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=C51A453 smtp.mailfrom=david.laight@aculab.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: aculab.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org From: Kees Cook > Sent: 31 January 2022 20:44 > > The __is_constexpr() macro is dark magic. Shed some light on it with > a comment to explain how and why it works. > ... > diff --git a/include/linux/const.h b/include/linux/const.h > index 435ddd72d2c4..7122d6a1f8ce 100644 > --- a/include/linux/const.h > +++ b/include/linux/const.h > @@ -7,6 +7,30 @@ > * This returns a constant expression while determining if an argument is > * a constant expression, most importantly without evaluating the argument. > * Glory to Martin Uecker > + * > + * Details: > + * - sizeof() is an integer constant expression, and does not evaluate the > + * value of its operand; it only examines the type of its operand. > + * - The results of comparing two integer constant expressions is also > + * an integer constant expression. > + * - The use of literal "8" is to avoid warnings about unaligned pointers; > + * these could otherwise just be "1"s. > + * - (long)(x) is used to avoid warnings about 64-bit types on 32-bit > + * architectures. > + * - The C standard defines an "integer constant expression" as different > + * from a "null pointer constant" (an integer constant 0 pointer). > + * - The conditional operator ("... ? ... : ...") returns the type of the > + * operand that isn't a null pointer constant. This behavior is the > + * central mechanism of the macro. > + * - If (x) is an integer constant expression, then the "* 0l" resolves it > + * into a null pointer constant, which forces the conditional operator > + * to return the type of the last operand: "(int *)". > + * - If (x) is not an integer constant expression, then the type of the > + * conditional operator is from the first operand: "(void *)". > + * - sizeof(int) == 4 and sizeof(void) == 1. > + * - The ultimate comparison to "sizeof(int)" chooses between either: > + * sizeof(*((int *) (8)) == sizeof(int) (x was a constant expression) > + * sizeof(*((void *)(8)) == sizeof(void) (x was not a constant expression) > */ > #define __is_constexpr(x) \ > (sizeof(int) == sizeof(*(8 ? ((void *)((long)(x) * 0l)) : (int *)8))) This has been making my head hurt all day. The above isn't really a true description - ?: doesn't work that way. Try the following for size: - The conditional operator (?:) requires that both expressions have the the same type (after numeric promotions). The type of the result is a compile time constant and doesn't depend on any variables. - If the expressions have distinct non-NULL pointer types then they are both cast to (void *) and the result has type 'void *'. - A NULL pointer can be made from any integer constant expression that evaluates to 0, not just a literal 0. - So the type of (0 ? (void *)(x) : (int *)8) is 'int *' if (x) is zero (because of the NULL) and (void *) otherwise because the pointer types don't match. You can test this by evaluating: sizeof *(0 ? (float *)4 : (int *)4) This is 1 because of the implicit (void *) cast. I'd also delete the l from the 0l - it isn't needed. (Or at least use L) David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)