Re: [PATCH v3 5/5] string: Make strprefix() const-qualifier-generic

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential
issues to consider:
- [High] string: strprefix() breaks Clang builds via void * subscript in
  QVoid_of()
- [Medium] string: strprefix() always returns char * due to non-const
  (strprefix)()
- [Low] string: strprefix() macro parameter pfx mismatches @prefix
  kernel-doc
--

commit f882ec908122ee0c3f780648b859ed41700664d0
Author: Alejandro Colomar <alx@kernel.org>

string: Make strprefix() const-qualifier-generic

This commit wraps strprefix() in a const_cast(CQChar_of(s) *, ...) macro so
that its return type preserves the const qualifier of its first argument.

> diff --git a/include/linux/string.h b/include/linux/string.h
> index cb096e9eb9835..3e8a0537b86bb 100644
> --- a/include/linux/string.h
> +++ b/include/linux/string.h
> @@ -577,7 +577,9 @@ void memcpy_and_pad(void *dest, size_t dest_len, const void *src, size_t count,
>   * *  @s+strlen(@prefix) if @s starts with @prefix
>   * *  NULL if @s does not start with @prefix
>   */
> -static inline char *strprefix(const char *s, const char *prefix)
> +#define strprefix(s, pfx)  const_cast(CQChar_of(s) *, strprefix(s, pfx))

[Severity: High]
Does expanding CQChar_of(s) here break Clang builds (make LLVM=1)?

CQChar_of(s) expands to QChar_of(const, s), which expands QVoid_of(s):

include/linux/string.h:
#define QVoid_of(p)       typeof((__QVoidptr_of(p)){0}[0])
#define __QVoidptr_of(p)  typeof(1?(p):(void*){0})

Because __QVoidptr_of(p) is void * or const void *, applying the [0] array
subscript operator to it fails to compile under Clang ("error: subscript of a
pointer to void") in every translation unit that calls strprefix(), such as
drivers/base/property.c, and triggers -Wpointer-arith under W=3 in GCC.

[Severity: Low]
Does naming the macro parameter pfx instead of prefix cause scripts/kernel-doc
warnings?  The kernel-doc comment immediately above documents @prefix, and
scripts/kernel-doc binds that comment to the macro definition that follows it.

> +
> +static inline char *(strprefix)(const char *s, const char *prefix)
>  {
>  	size_t len = strlen(prefix);
>  	return strncmp(s, prefix, len) == 0 ? (char *) s + len : NULL;

[Severity: Medium]
Does strprefix(s, pfx) still unconditionally return char * even when s is
const char *?

include/linux/stddef.h:
#define const_cast(T, p)  _Generic(p, const T: (T) (p), default: (p))

In const_cast(CQChar_of(s) *, strprefix(s, pfx)), the first _Generic
association is const CQChar_of(s) *, which is const char *.  Because the
underlying (strprefix)() function returns char *, the controlling expression
never matches const char * and always selects the default branch, returning
an unqualified char * and stripping const from read-only strings.  Should
(strprefix)() return const char * and avoid casting s to char *?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1794323750.git.alx@kernel.org?part=5