On Fri, Sep 16, 2022 at 01:07:25AM -0700, Kees Cook wrote:
> On Thu, Sep 15, 2022 at 05:09:45PM +0300, Dan Carpenter wrote:
> > It would probaby be useful to mark passed data as explicitly unsafe for
> > integer overflows.  Smatch already tracks user data.  And if the user
> > data has been capped to an unknown value.  But this would be a
> > completely separate flag which says that "this value came from
> > size_add/mul()".
> 
> I really want a __must_check_type(size_t) attribute or something for
> functions, so we can get a subset of -Wconversion warnings, etc.
> 

I have a list of these.  Attached.

> > drivers/char/tpm/eventlog/tpm2.c:57 tpm2_bios_measurements_start() warn: using integer overflow function 'size_add()' for math
> > [...]
> > drivers/net/ethernet/intel/ice/ice_flex_pipe.c:2070 ice_pkg_buf_reserve_section() warn: using integer overflow function 'size_mul()' for math
> 
> I see size_add() and size_mul() here. I would have expected some
> size_sub() opportunities too? Did nothing pop out?

I didn't look at size_sub().  I'll add it to the mix and report back on
Monday.

regards,
dan carpenter