From: Bill Wendling <morbo@google.com>
To: Kees Cook <kees@kernel.org>, ardb@kernel.org
Cc: gustavoars@kernel.org, nathan@kernel.org,
ndesaulniers@google.com, justinstitt@google.com,
broonie@kernel.org, elver@google.com, alan.maguire@oracle.com,
namjain@linux.microsoft.com, peterz@infradead.org,
linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org,
llvm@lists.linux.dev, Bill Wendling <morbo@google.com>
Subject: [PATCH v3] compiler_types: Allow opting out of __counted_by and __counted_by_ptr
Date: Mon, 5 Oct 2026 19:20:52 +0000 [thread overview]
Message-ID: <20261005192052.2589382-1-morbo@google.com> (raw)
In-Reply-To: <20261005102518.2400984-1-morbo@google.com>
Code that runs outside the kernel proper, such as the EFI stub, gets
nothing out of the counted_by annotations: the bounds checks they feed
(FORTIFY_SOURCE, UBSAN_BOUNDS) are already disabled there.
The annotations can also break the build. A __counted_by_ptr() that
names a member declared after the pointer needs Clang's
'-fexperimental-late-parse-attributes', which the top-level Makefile
adds to 'KBUILD_CFLAGS'. The x86 EFI stub builds its own cflags and does
not get that flag, so it fails as soon as such a struct is pulled in
through a common header.
Overriding the __counted_by_ptr macro from a Makefile doesn't work:
'compiler_types.h' is pulled in with '-include', which is processed
after all -D/-U options, so it re-establishes the definitions. Follow
the '__NO_FORTIFY' precedent instead: let a build define
'__NO_COUNTED_BY_PTR' to turn the corresponding annotation into a no-op.
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
---
v2: Only specify __NO_COUNTED_BY_PTR. Leave __NO_COUNTED_BY until we need it.
v3: Add the version to the Subject line.
---
include/linux/compiler_types.h | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index c5921f139007..8bde6798b4ec 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -387,8 +387,13 @@ struct ftrace_likely_data {
*
* gcc: https://gcc.gnu.org/pipermail/gcc-patches/2025-April/681727.html
* clang: https://clang.llvm.org/docs/AttributeReference.html#counted-by-counted-by-or-null-sized-by-sized-by-or-null
+ *
+ * Code that runs outside the kernel proper (e.g. the EFI stub) can define
+ * __NO_COUNTED_BY_PTR to drop the annotation. Such code may also lack the flag
+ * Clang needs to parse a reference to a later-declared member
+ * (-fexperimental-late-parse-attributes).
*/
-#ifdef CONFIG_CC_HAS_COUNTED_BY_PTR
+#if defined(CONFIG_CC_HAS_COUNTED_BY_PTR) && !defined(__NO_COUNTED_BY_PTR)
#define __counted_by_ptr(member) __attribute__((__counted_by__(member)))
#else
#define __counted_by_ptr(member)
--
2.56.0.rc1.315.gc6ed9934b7-goog
next prev parent reply other threads:[~2026-10-05 19:21 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-05 10:25 [PATCH] compiler_types: Allow opting out of __counted_by and __counted_by_ptr Bill Wendling
2026-10-05 10:44 ` Justin Stitt
2026-10-05 10:53 ` Ard Biesheuvel
2026-10-05 15:52 ` Bill Wendling
2026-10-05 19:19 ` Bill Wendling
2026-10-05 19:20 ` Bill Wendling [this message]
2026-10-05 21:25 ` [PATCH v3] " Ard Biesheuvel
2026-10-06 7:30 ` Justin Stitt
2026-10-06 8:07 ` Ard Biesheuvel
2026-10-06 9:23 ` Bill Wendling
2026-10-06 9:43 ` [PATCH v4] " Bill Wendling
2026-10-06 10:08 ` Ard Biesheuvel
2026-10-06 13:46 ` Bill Wendling
2026-10-06 14:12 ` Kees Cook
2026-10-07 9:09 ` Nathan Chancellor
2026-10-07 9:32 ` Bill Wendling
2026-10-07 9:36 ` Nathan Chancellor
2026-10-08 14:50 ` Ard Biesheuvel
2026-10-08 16:17 ` Nathan Chancellor
2026-10-08 16:40 ` Ard Biesheuvel
2026-10-08 20:29 ` Bill Wendling
2026-10-06 13:45 ` [PATCH v5] " Bill Wendling
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261005192052.2589382-1-morbo@google.com \
--to=morbo@google.com \
--cc=alan.maguire@oracle.com \
--cc=ardb@kernel.org \
--cc=broonie@kernel.org \
--cc=elver@google.com \
--cc=gustavoars@kernel.org \
--cc=justinstitt@google.com \
--cc=kees@kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=llvm@lists.linux.dev \
--cc=namjain@linux.microsoft.com \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=peterz@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.