From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5040F28AAE6 for ; Mon, 22 Sep 2025 09:33:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758533617; cv=none; b=HGSTXpbFyNfvRiKhKXumalm9EZb8kery7rHsVoQMHQ9M7r6JmXbZdlzSY/u79oRpRoSoAldND9Gdwe8Qri797Ix07fdy7GyXC+GnvzheSF4QPNfRAFiSJoByTK/BF6zUHTSPoXyVR9rSM+uUJ7/m3w+FPc3fd6Ukv9h/2DlN0W4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758533617; c=relaxed/simple; bh=uR7IyOLN2X3biDgABs/idhTRrUaMmnWVYyN/UzgtCKU=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=Gv0t3VogfL5i/wSDZfDso2HUyJ2R6wPiF9a7uOR06OUReCwWGq/mvLrw6HB8fVowX8UkpgTGYQ/hqWAilDI148xx1m6pMIj359ES8uaA3b2wYYxT4asc9MrJA2kRi1eCEuPYCu9HagZjLDaq9UnYSHLX9bDJhSKZqKoJfmNXuhc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=rtqRVKgw; arc=none smtp.client-ip=209.85.128.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="rtqRVKgw" Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-45f2c9799a3so30937375e9.0 for ; Mon, 22 Sep 2025 02:33:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1758533613; x=1759138413; darn=vger.kernel.org; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=89qPC2dMk40SQhoKG37yGCiQt/NY420sGfty0Meng0w=; b=rtqRVKgwXVLDUPMcssfmWmAiw96i6zfxA/t2vqhdNA5YUqKeezt2pPCKNqVyuYTQE4 gVXMk/0hOTwX4zwKdwi3p146YZma2gcgaSCBW29dZqy7v7TEgm2EGs84QxoYNsAn1znb slwzGELxqwII971SnlHT1bDj6nwjAKtx20WV+dXWzoBKLw4zi9u0z8u4f7HVH9w+TcqV fk7//ZiYPMZISgktY4gCh/huytX2ZwLjvMMgStS6ETfULKiiydWXMY4YMns37F16PFVb 6hWHTbG4lZj71aB+/CtXTslBsPyT7fXYYYekfTbAhGw5cudJI4ZwVFn3PDSnYXowHJ5p kIXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1758533613; x=1759138413; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=89qPC2dMk40SQhoKG37yGCiQt/NY420sGfty0Meng0w=; b=qKv/JwEqt9lyswcheK2T//0f49CoI/pXB/OEJt17n03ifPOgEiW9e3oGBlofTfuR1e kLWM2M93aiopmHL+FGoEfYRUUyPJfrsGFbBT9u+XUWT2pNhXUYEO+SfogYr6bTlavIIp oaWBVa4eVDXK7LF9fYKaGuakNAhfa3F/X2AR5GS1K1qmY4ZHvjrMDcfgIqGuiILRCeB9 hC9Bjjpccp3xUaG9Wk7laQ6HP1XMHajQvlCLAASd81PVQcIEImsRUyYOpdIHXDV3fAsb WjyCLe6Saqzlaa/Kr1ooDEscz7rXd8GMW+D0BtIsq1nuPCAPul3o2iL+/dMVXLTHjzrD mcQA== X-Forwarded-Encrypted: i=1; AJvYcCUoREZjy/FsHqDCMbs9k6m1CUQEujGG0RlGqvtN0WAXih8dKaCumaEXe7Bkh30O0uwMIQ+8f4E7jG2Qc5SVNFJTbD5jJnI=@vger.kernel.org X-Gm-Message-State: AOJu0Yy124qY0zP+IBQDwt/N+8qPoesY/+ZBFiHz2ccfNVaWWLhw0EyW QYC8k8DkRf2UP8tBpt4l30k031ocyAq9qRwb059+rwHqjipS+3FAzYDVCqP0PGFUpw== X-Gm-Gg: ASbGnctnJetfoI7hxwMyPC41wgQzUpRjKBjoisUtmExcey7BFTG0nq6z5MTeM1bAfLk hmjI594D9ZkCbC/3bsFZBs1Sz2Xmo5aGxJ2a/6Uz0OZDJxJy4bNouU8tm2g/++yYhgWTVLjAFzV 9OP/m6IuFBbEROc4+9SvFYZjdFWyocpAZ3qGMDqY7KWTGpHf+oT+FK0pxeer/voTIpk58/e9ds8 mRZlQpAjPU3kNP2kWy4bd4u/i8uf7Mu7YgxpwLmpCR58QCcaSrOqLWirmG79OgpTiTg+96lut4P cES6q/uhLuPU+IYTKyB5Lyc5FbL0On8MmUgMaLqiPSiFSazKWrIEUY0vKP77FRnDfTmpf9vMXvt Rh2rLMgvbfyQ8RH73O6m43ABuH4VZLbFInYOH3c8rOwsJm5kXL5ZovEdDOUg= X-Google-Smtp-Source: AGHT+IEkoU9ognY1IS2/WNXTQHBehT3iG6jr+rUMfSA5BLARxzu2twytBIMtwJpeHRGrTnG81Cn1IQ== X-Received: by 2002:a05:600c:46c6:b0:45b:804a:a65e with SMTP id 5b1f17b1804b1-467ebbbff33mr123610355e9.28.1758533612329; Mon, 22 Sep 2025 02:33:32 -0700 (PDT) Received: from elver.google.com ([2a00:79e0:2834:9:8fed:21ad:ce77:2e15]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-46d1f3e1b03sm39713145e9.23.2025.09.22.02.33.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Sep 2025 02:33:31 -0700 (PDT) Date: Mon, 22 Sep 2025 11:33:23 +0200 From: Marco Elver To: Christoph Hellwig Cc: Nathan Chancellor , Peter Zijlstra , Boqun Feng , Ingo Molnar , Will Deacon , "David S. Miller" , Luc Van Oostenryck , "Paul E. McKenney" , Alexander Potapenko , Arnd Bergmann , Bart Van Assche , Bill Wendling , Dmitry Vyukov , Eric Dumazet , Frederic Weisbecker , Greg Kroah-Hartman , Herbert Xu , Ian Rogers , Jann Horn , Joel Fernandes , Jonathan Corbet , Josh Triplett , Justin Stitt , Kees Cook , Kentaro Takeda , Lukas Bulwahn , Mark Rutland , Mathieu Desnoyers , Miguel Ojeda , Neeraj Upadhyay , Nick Desaulniers , Steven Rostedt , Tetsuo Handa , Thomas Gleixner , Thomas Graf , Uladzislau Rezki , Waiman Long , kasan-dev@googlegroups.com, linux-crypto@vger.kernel.org, linux-doc@vger.kernel.org, linux-kbuild@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-security-module@vger.kernel.org, linux-sparse@vger.kernel.org, llvm@lists.linux.dev, rcu@vger.kernel.org Subject: Re: [PATCH v3 00/35] Compiler-Based Capability- and Locking-Analysis Message-ID: References: <20250918140451.1289454-1-elver@google.com> <20250918141511.GA30263@lst.de> <20250918174555.GA3366400@ax162> <20250919140803.GA23745@lst.de> <20250919140954.GA24160@lst.de> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20250919140954.GA24160@lst.de> User-Agent: Mutt/2.2.13 (2024-03-09) On Fri, Sep 19, 2025 at 04:09PM +0200, Christoph Hellwig wrote: > On Fri, Sep 19, 2025 at 04:08:03PM +0200, Christoph Hellwig wrote: > > I started to play around with that. For the nvme code adding the > > annotations was very simply, and I also started adding trivial > > __guarded_by which instantly found issues. > > > > For XFS it was a lot more work and I still see tons of compiler > > warnings, which I'm not entirely sure how to address. Right now I > > see three major classes: > > And in case anyone cares, here are my patches for that: > > https://git.infradead.org/?p=users/hch/misc.git;a=shortlog;h=refs/heads/cap-analysis > > git://git.infradead.org/users/hch/misc.git cap-analysis I gave this a try, and with the below patch and the Clang fix [1], fs/xfs compiles cleanly. I think the fundamental limitation are the conditional locking wrappers. I suspect it's possible to do better than disabling the analysis here, by overapproximating the lock set taken (like you did elsewhere), so that at least the callers are checked, but when I tried it showed lots of callers need annotating as well, so I gave up at that point. Still, it might be better than no checking at all. [1] https://github.com/llvm/llvm-project/pull/159921 Thanks, -- Marco diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c index 9c39251961a3..f371a08e5d44 100644 --- a/fs/xfs/xfs_inode.c +++ b/fs/xfs/xfs_inode.c @@ -140,6 +140,7 @@ void xfs_ilock( xfs_inode_t *ip, uint lock_flags) + __capability_unsafe(/* conditional locking */) { trace_xfs_ilock(ip, lock_flags, _RET_IP_); @@ -183,6 +184,7 @@ int xfs_ilock_nowait( xfs_inode_t *ip, uint lock_flags) + __capability_unsafe(/* conditional locking */) { trace_xfs_ilock_nowait(ip, lock_flags, _RET_IP_); @@ -243,6 +245,7 @@ void xfs_iunlock( xfs_inode_t *ip, uint lock_flags) + __capability_unsafe(/* conditional locking */) { xfs_lock_flags_assert(lock_flags); @@ -272,6 +275,7 @@ void xfs_ilock_demote( xfs_inode_t *ip, uint lock_flags) + __capability_unsafe(/* conditional locking */) { ASSERT(lock_flags & (XFS_IOLOCK_EXCL|XFS_MMAPLOCK_EXCL|XFS_ILOCK_EXCL)); ASSERT((lock_flags & diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c index d9ac9521c203..9c4ec3aa8bf9 100644 --- a/fs/xfs/xfs_log.c +++ b/fs/xfs/xfs_log.c @@ -472,6 +472,7 @@ xfs_log_reserve( static void xlog_state_shutdown_callbacks( struct xlog *log) + __must_hold(&log->l_icloglock) { struct xlog_in_core *iclog; LIST_HEAD(cb_list);