From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f201.google.com (mail-pg1-f201.google.com [209.85.215.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 321822C08D0 for ; Wed, 14 Jan 2026 19:37:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768419447; cv=none; b=Rtf6K1dMhaZXisy82tTGLcXTHU002Gwj+cHDJfEhGn+yaCnKSWzqepEd4jmfnzs2DJ3w5h9K1OR+e35ZBbcFAzmaUTP0Y99U2zV3Pjuz5Ma+lc0rGrKw6DN2woSv8nOJOojhjBOAYX11brqFcKmm/fmZPW26HBwBqo/WicNkFLk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768419447; c=relaxed/simple; bh=EQdSM0yOXS8C3leRvmeb2QGrjb/3aaIMy7AzLXYJTsQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: Cc:Content-Type; b=L8yfaPqA17e5Hgmi9HO6wjyOIvOLk806jjqQWNvi43ebBND9TggdUsV5s4tZ12zPZNOjxszkiojgR+jyjj71bFzXUgAgqT67fBsX/i+eJQ0PlmDtan/nGbZNJxayuwRNcBwlgc5TYLNuWAm/vqwt/tEK0pww1scppJhp8JcqJGE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--morbo.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=z7A8N232; arc=none smtp.client-ip=209.85.215.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--morbo.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="z7A8N232" Received: by mail-pg1-f201.google.com with SMTP id 41be03b00d2f7-c5539b9adc3so113661a12.1 for ; Wed, 14 Jan 2026 11:37:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1768419445; x=1769024245; darn=vger.kernel.org; h=content-transfer-encoding:cc:from:subject:message-id:references :mime-version:in-reply-to:date:from:to:cc:subject:date:message-id :reply-to; bh=PJ1Oy9t9P+wnGwZGZn0q3AykJg67xBsGj9QaYqlCMiU=; b=z7A8N232L456+7aKqdZMR7IV2lngaQQ1Qda+5ci5SPpwgSYCFaLyqEHGzgLqJEk0J2 QB2o4k3Iip8W6NQi6//LK47ZAp/PhN4VQ2f7jtEp+vO4S0F7zc0adUwDmg7lMemNWH38 8GiU658LcyJVVMdCNrCh/lYaBx9G9I7XjYXOTr+zMvpqMTm4g1nAvYe2oRNDJW7eo9qe nsvVoaiOuW7X96fKr12yt+WPdlZtdeXvQo6MRhIfs3/BU4W+A2r8YzIs8y4q0FDecqjI WSTqIVQ6KgV+xAaE3mBfM28AvVsVwqGqDOf6mrl0zx99mnkfjVcV7QnYT3pbDdk3GLCj PVYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768419445; x=1769024245; h=content-transfer-encoding:cc:from:subject:message-id:references :mime-version:in-reply-to:date:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=PJ1Oy9t9P+wnGwZGZn0q3AykJg67xBsGj9QaYqlCMiU=; b=Z8brSKviqifuXZHJlfX9dvDR/UvH7JYzlqPp15pSAOGwZdholY5v6FUoodVP925Gth cNf2/9NE5euLXBVq8YosuSuwc08Im5F97al5odJWv2QQPqBxV7sYor7sF5MS7MmiOlZM baWB231aycFAE4vYM7dHD1Jq+JLDA8cY8BsQUyvg2+u8qetE42LTsd4DVykA+/ly31SQ WYEE0Cah5XnRDMAekdML0lyGYPmJ3us7GnASoDbFKUoXRmk59GkxMUZIBq61xSO4gJDh LAUDKDQ1tdkOa66gGbxtfDAQfgffXYzHJlDbr2OR9F6GvcIgzHSqXbok1uPpb8cRHJQ1 1uyA== X-Forwarded-Encrypted: i=1; AJvYcCXqw8rQkLukrks1EeTGp6ceZeCue+/uf8uBQw/9kaiXnk16RomioTAzHBDrWTLaD9JSKJtGaZ2sDLGhaIg5VwM=@vger.kernel.org X-Gm-Message-State: AOJu0YzWwPgqdbt19Z+vXznTOMIp6TBZzJSjJsFYcBzDMO9g3VlSd5KX tar8S9McunxYcOwacak5LICXn0HScaYZ6ELEy3nYBLpvT8GewWjUXMPAtobibkfS+5dYsds6dnc M X-Received: from pgnd16.prod.google.com ([2002:a63:7350:0:b0:bfe:d576:aabd]) (user=morbo job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:7f97:b0:38b:d95d:efd7 with SMTP id adf61e73a8af0-38bed1b9f0emr4607629637.44.1768419445289; Wed, 14 Jan 2026 11:37:25 -0800 (PST) Date: Wed, 14 Jan 2026 19:36:47 +0000 In-Reply-To: <20251121195504.1661783-1-morbo@google.com> Precedence: bulk X-Mailing-List: linux-hardening@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251121195504.1661783-1-morbo@google.com> X-Mailer: git-send-email 2.52.0.457.g6b5491de43-goog Message-ID: <20260114193716.1740684-1-morbo@google.com> Subject: [PATCH 1/2] Compiler Attributes: Add __counted_by_ptr macro From: Bill Wendling Cc: Bill Wendling , Kees Cook , "Gustavo A. R. Silva" , Nathan Chancellor , Nick Desaulniers , Justin Stitt , Miguel Ojeda , Peter Zijlstra , Andrew Morton , Heiko Carstens , Marc Herbert , Uros Bizjak , Tejun Heo , Jeff Xu , "=?UTF-8?q?Michal=20Koutn=C3=BD?=" , Shakeel Butt , "=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?=" , John Stultz , Christian Brauner , Randy Dunlap , Brian Gerst , Masahiro Yamada , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, llvm@lists.linux.dev, Nicolas Schier , Tamir Duberstein , Steven Rostedt , "Jason A. Donenfeld" , "H. Peter Anvin" , Naman Jain , Eric Dumazet , Simon Horman , Jakub Kicinski , Paolo Abeni , Ingo Molnar , Thomas Gleixner , Douglas Anderson , linux-kbuild@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Introduce __counted_by_ptr(), which works like __counted_by(), but for pointer struct members. struct foo { int a, b, c; char *buffer __counted_by_ptr(bytes); short nr_bars; struct bar *bars __counted_by_ptr(nr_bars); size_t bytes; }; Because "counted_by" can only be applied to pointer members in very recent compiler versions, its application ends up needing to be distinct from flexibe array "counted_by" annotations, hence a separate macro. Note that Clang's support for "void *" members will be in version 22. So, when using Clang, you'll need to wait until its release before using the feature with "void *". No such restriction applies to GCC's version 16. This is a reworking of Kees' previous patch [1]. Link: https://lore.kernel.org/all/20251020220118.1226740-1-kees@kernel.org/= [1] Co-developed-by: Kees Cook Signed-off-by: Bill Wendling --- Cc: Kees Cook Cc: "Gustavo A. R. Silva" Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Justin Stitt Cc: Miguel Ojeda Cc: Peter Zijlstra Cc: Andrew Morton Cc: Heiko Carstens Cc: Marc Herbert Cc: Uros Bizjak Cc: Tejun Heo Cc: Jeff Xu Cc: "Michal Koutn=C3=BD" Cc: Shakeel Butt Cc: "Thomas Wei=C3=9Fschuh" Cc: John Stultz Cc: Christian Brauner Cc: Randy Dunlap Cc: Brian Gerst Cc: Masahiro Yamada Cc: linux-kernel@vger.kernel.org Cc: linux-hardening@vger.kernel.org Cc: llvm@lists.linux.dev --- v3 - Replace the previous code with a modified version of Kees' previous pa= tch [1]. - The question about the naming of the macro was considered, but we deci= ded to keep the original naming (__counted_by_ptr), because it mirrors the= current macros like "__counted_by_{le,be}". v2 - Add support for GCC. --- Makefile | 6 ++++++ include/linux/compiler_types.h | 18 +++++++++++++++++- include/uapi/linux/stddef.h | 4 ++++ init/Kconfig | 7 +++++++ 4 files changed, 34 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 9d38125263fb..6b029f694bc2 100644 --- a/Makefile +++ b/Makefile @@ -952,6 +952,12 @@ KBUILD_CFLAGS +=3D $(CC_AUTO_VAR_INIT_ZERO_ENABLER) endif endif =20 +ifdef CONFIG_CC_IS_CLANG +ifdef CONFIG_CC_HAS_COUNTED_BY_PTR +KBUILD_CFLAGS +=3D -fexperimental-late-parse-attributes +endif +endif + # Explicitly clear padding bits during variable initialization KBUILD_CFLAGS +=3D $(call cc-option,-fzero-init-padding-bits=3Dall) =20 diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.= h index d3318a3c2577..e597c814d60b 100644 --- a/include/linux/compiler_types.h +++ b/include/linux/compiler_types.h @@ -369,7 +369,7 @@ struct ftrace_likely_data { * Optional: only supported since clang >=3D 18 * * gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D108896 - * clang: https://github.com/llvm/llvm-project/pull/76348 + * clang: https://clang.llvm.org/docs/AttributeReference.html#counted-by-c= ounted-by-or-null-sized-by-sized-by-or-null * * __bdos on clang < 19.1.2 can erroneously return 0: * https://github.com/llvm/llvm-project/pull/110497 @@ -383,6 +383,22 @@ struct ftrace_likely_data { # define __counted_by(member) #endif =20 +/* + * Runtime track number of objects pointed to by a pointer member for use = by + * CONFIG_FORTIFY_SOURCE and CONFIG_UBSAN_BOUNDS. + * + * Optional: only supported since gcc >=3D 16 + * Optional: only supported since clang >=3D 21.1 + * + * gcc: https://gcc.gnu.org/pipermail/gcc-patches/2025-April/681727.html + * clang: https://github.com/llvm/llvm-project/pull/137250 + */ +#ifdef CONFIG_CC_HAS_COUNTED_BY_PTR +#define __counted_by_ptr(member) __attribute__((__counted_by__(member))) +#else +#define __counted_by_ptr(member) +#endif + /* * Optional: only supported since gcc >=3D 15 * Optional: not supported by Clang diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h index 9a28f7d9a334..111b097ec00b 100644 --- a/include/uapi/linux/stddef.h +++ b/include/uapi/linux/stddef.h @@ -72,6 +72,10 @@ #define __counted_by_be(m) #endif =20 +#ifndef __counted_by_ptr +#define __counted_by_ptr(m) +#endif + #ifdef __KERNEL__ #define __kernel_nonstring __nonstring #else diff --git a/init/Kconfig b/init/Kconfig index fa79feb8fe57..dc27b998d111 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -143,6 +143,13 @@ config CC_HAS_COUNTED_BY # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D108896 default y if CC_IS_GCC && GCC_VERSION >=3D 150100 =20 +config CC_HAS_COUNTED_BY_PTR + bool + # supported since clang 21.1.0 + default y if CC_IS_CLANG && CLANG_VERSION >=3D 210100 + # supported since gcc 16.0.0 + default y if CC_IS_GCC && GCC_VERSION >=3D 160000 + config CC_HAS_MULTIDIMENSIONAL_NONSTRING def_bool $(success,echo 'char tag[][4] __attribute__((__nonstring__)) =3D= { };' | $(CC) $(CLANG_FLAGS) -x c - -c -o /dev/null -Werror) =20 --=20 2.52.0.457.g6b5491de43-goog