[PATCH 0/6] sysfs: prepare the constification of struct attribute

[PATCH 0/6] sysfs: prepare the constification of struct attribute

[Thomas Weißschuh]

The migration of 'struct attribute' and its related structures and
macros are more complicated than those for 'struct bin_attribute'.
Mostly because they are all shared by various custom attribute types.
Introduce some initial utilities to support the migration.
These are enough to migrate some specialized attributes atomically or
those which don't use 'struct attribute' in their callbacks stepwise.

The big outstanding problems are 'struct device_attribute' and
'struct kobj_attribute'. These are used everywhere and I'm not yet sure
about a migration plan.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
---
Thomas Weißschuh (6):
      sysfs: attribute_group: allow registration of const attribute
      sysfs: transparently handle const pointers in ATTRIBUTE_GROUPS()
      sysfs: introduce __SYSFS_FUNCTION_ALTERNATIVE()
      sysfs: attribute_group: enable const variants of is_visible()
      samples/kobject: add is_visible() callback to attribute group
      samples/kobject: constify 'struct foo_attribute'

 fs/sysfs/group.c               | 10 ++++++++--
 include/linux/sysfs.h          | 26 +++++++++++++++++++++----
 samples/kobject/kset-example.c | 44 ++++++++++++++++++++++++++++--------------
 3 files changed, 60 insertions(+), 20 deletions(-)
---
base-commit: 619f0b6fad524f08d493a98d55bac9ab8895e3a6
change-id: 20250114-sysfs-const-attr-prep-e9414982dc4f

Best regards,
-- 
Thomas Weißschuh <linux@weissschuh.net>

[PATCH 1/6] sysfs: attribute_group: allow registration of const attribute

[Thomas Weißschuh]

To be able to constify instances of struct attribute it has to be
possible to add them to struct attribute_group.
The current type of the attrs member however is not compatible with that.
Introduce a union that allows registration of both const and non-const
attributes to enable a piecewise transition.
As both union member types are compatible no logic needs to be adapted.

Technically it is now possible register a const struct
attribute and receive it as mutable pointer in the callbacks.
This is a soundness issue.
But this same soundness issue already exists today in
sysfs_create_file().
Also the struct definition and callback implementation are always
closely linked and are meant to be moved to const in lockstep.

Similar to commit 906c508afdca ("sysfs: attribute_group: allow registration of const bin_attribute")

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
---
 include/linux/sysfs.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index 0f2fcd244523f050c5286f19d4fe1846506f9214..f5e25bed777a6a6e717f10973f1abcd12111f5c5 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -105,7 +105,10 @@ struct attribute_group {
 	size_t			(*bin_size)(struct kobject *,
 					    const struct bin_attribute *,
 					    int);
-	struct attribute	**attrs;
+	union {
+		struct attribute	**attrs;
+		const struct attribute	*const *attrs_new;
+	};
 	union {
 		struct bin_attribute		**bin_attrs;
 		const struct bin_attribute	*const *bin_attrs_new;

-- 
2.48.1

[PATCH 2/6] sysfs: transparently handle const pointers in ATTRIBUTE_GROUPS()

[Thomas Weißschuh]

To ease the constification process of 'struct attribute', transparently
handle the const pointers in ATTRIBUTE_GROUPS().
A cast is used instead of assigning to .attrs_new as it keeps the macro
smaller. As both members are aliased to each other the result is
identical.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
---
 include/linux/sysfs.h | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index f5e25bed777a6a6e717f10973f1abcd12111f5c5..52d4862bbcef2a6b143710a19801222bf7abc346 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -290,7 +290,12 @@ static const struct attribute_group *_name##_groups[] = {	\
 
 #define ATTRIBUTE_GROUPS(_name)					\
 static const struct attribute_group _name##_group = {		\
-	.attrs = _name##_attrs,					\
+	.attrs = _Generic(_name##_attrs,			\
+			  struct attribute **:			\
+				_name##_attrs,			\
+			  const struct attribute *const *:	\
+				(void *)_name##_attrs		\
+	),							\
 };								\
 __ATTRIBUTE_GROUPS(_name)
 

-- 
2.48.1

[PATCH 3/6] sysfs: introduce __SYSFS_FUNCTION_ALTERNATIVE()

[Thomas Weißschuh]

For the constification phase of 'struct attribute' various callback
struct members will need to exist in both const and non-const variants.
Keeping both members in a union avoids memory and CPU overhead but will
be detected and trapped by Control Flow Integrity (CFI).
By deciding between a struct and a union depending whether CFI is
enabled, most configurations can avoid this overhead.
Code using these callbacks will still need to be updated to handle both
members explicitly.
In the union case the compiler will recognize that testing for one union
member is enough and optimize away the code for the other one.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
---
 include/linux/sysfs.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index 52d4862bbcef2a6b143710a19801222bf7abc346..46e9261bc35f248a733d27c05c931080b0c58e17 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -58,6 +58,12 @@ do {							\
 #define sysfs_attr_init(attr) do {} while (0)
 #endif
 
+#ifdef CONFIG_CFI_CLANG
+#define __SYSFS_FUNCTION_ALTERNATIVE(MEMBERS...) struct { MEMBERS }
+#else
+#define __SYSFS_FUNCTION_ALTERNATIVE(MEMBERS...) union { MEMBERS }
+#endif
+
 /**
  * struct attribute_group - data structure used to declare an attribute group.
  * @name:	Optional: Attribute group name

-- 
2.48.1

[PATCH 4/6] sysfs: attribute_group: enable const variants of is_visible()

[Thomas Weißschuh]

When constifying instances of struct attribute, for consistency the
corresponding .is_visible() callback should be adapted, too.
Introduce a temporary transition mechanism until all callbacks are
converted.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
---
 fs/sysfs/group.c      | 10 ++++++++--
 include/linux/sysfs.h |  8 ++++++--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/fs/sysfs/group.c b/fs/sysfs/group.c
index 8b01a7eda5fb3239e138372417d01967c7a3f122..2a227bf209f84f5bfe5da06a5ca1633f69ca4368 100644
--- a/fs/sysfs/group.c
+++ b/fs/sysfs/group.c
@@ -36,6 +36,9 @@ static umode_t __first_visible(const struct attribute_group *grp, struct kobject
 	if (grp->attrs && grp->attrs[0] && grp->is_visible)
 		return grp->is_visible(kobj, grp->attrs[0], 0);
 
+	if (grp->attrs && grp->attrs[0] && grp->is_visible_new)
+		return grp->is_visible_new(kobj, grp->attrs[0], 0);
+
 	if (grp->bin_attrs && grp->bin_attrs[0] && grp->is_bin_visible)
 		return grp->is_bin_visible(kobj, grp->bin_attrs[0], 0);
 
@@ -61,8 +64,11 @@ static int create_files(struct kernfs_node *parent, struct kobject *kobj,
 			 */
 			if (update)
 				kernfs_remove_by_name(parent, (*attr)->name);
-			if (grp->is_visible) {
-				mode = grp->is_visible(kobj, *attr, i);
+			if (grp->is_visible || grp->is_visible_new) {
+				if (grp->is_visible)
+					mode = grp->is_visible(kobj, *attr, i);
+				else
+					mode = grp->is_visible_new(kobj, *attr, i);
 				mode &= ~SYSFS_GROUP_INVISIBLE;
 				if (!mode)
 					continue;
diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index 46e9261bc35f248a733d27c05c931080b0c58e17..c68496ad5bcc7964b98291df689c7451cf75eac8 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -104,8 +104,12 @@ do {							\
  */
 struct attribute_group {
 	const char		*name;
-	umode_t			(*is_visible)(struct kobject *,
-					      struct attribute *, int);
+	__SYSFS_FUNCTION_ALTERNATIVE(
+		umode_t			(*is_visible)(struct kobject *,
+						      struct attribute *, int);
+		umode_t			(*is_visible_new)(struct kobject *,
+							  const struct attribute *, int);
+	);
 	umode_t			(*is_bin_visible)(struct kobject *,
 						  const struct bin_attribute *, int);
 	size_t			(*bin_size)(struct kobject *,

-- 
2.48.1

[PATCH 5/6] samples/kobject: add is_visible() callback to attribute group

[Thomas Weißschuh]

There was no example for the is_visible() callback so far.

It will also become an example and test for the constification of
'struct attribute' later.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
---
 samples/kobject/kset-example.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/samples/kobject/kset-example.c b/samples/kobject/kset-example.c
index 552d7e363539a8f82ab8e0446c732f85ed2c5612..7d8c68763ff8af696cbafaed1d5f1b173bb4860e 100644
--- a/samples/kobject/kset-example.c
+++ b/samples/kobject/kset-example.c
@@ -178,7 +178,22 @@ static struct attribute *foo_default_attrs[] = {
 	&bar_attribute.attr,
 	NULL,	/* need to NULL terminate the list of attributes */
 };
-ATTRIBUTE_GROUPS(foo_default);
+
+static umode_t foo_default_attrs_is_visible(struct kobject *kobj,
+					    struct attribute *attr,
+					    int n)
+{
+	/* Hide attributes with the same name as the kobject. */
+	if (strcmp(kobject_name(kobj), attr->name) == 0)
+		return 0;
+	return attr->mode;
+}
+
+static const struct attribute_group foo_default_group = {
+	.attrs		= foo_default_attrs,
+	.is_visible	= foo_default_attrs_is_visible,
+};
+__ATTRIBUTE_GROUPS(foo_default);
 
 /*
  * Our own ktype for our kobjects.  Here we specify our sysfs ops, the

-- 
2.48.1

[PATCH 6/6] samples/kobject: constify 'struct foo_attribute'

[Thomas Weißschuh]

Showcase and test the new 'struct attribute' constification facilities.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
---
 samples/kobject/kset-example.c | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/samples/kobject/kset-example.c b/samples/kobject/kset-example.c
index 7d8c68763ff8af696cbafaed1d5f1b173bb4860e..cbcfa628cc2801a7c4fc0d868898c4cfa539825c 100644
--- a/samples/kobject/kset-example.c
+++ b/samples/kobject/kset-example.c
@@ -37,10 +37,11 @@ struct foo_obj {
 /* a custom attribute that works just for a struct foo_obj. */
 struct foo_attribute {
 	struct attribute attr;
-	ssize_t (*show)(struct foo_obj *foo, struct foo_attribute *attr, char *buf);
-	ssize_t (*store)(struct foo_obj *foo, struct foo_attribute *attr, const char *buf, size_t count);
+	ssize_t (*show)(struct foo_obj *foo, const struct foo_attribute *attr, char *buf);
+	ssize_t (*store)(struct foo_obj *foo, const struct foo_attribute *attr,
+			 const char *buf, size_t count);
 };
-#define to_foo_attr(x) container_of(x, struct foo_attribute, attr)
+#define to_foo_attr(x) container_of_const(x, struct foo_attribute, attr)
 
 /*
  * The default show function that must be passed to sysfs.  This will be
@@ -53,7 +54,7 @@ static ssize_t foo_attr_show(struct kobject *kobj,
 			     struct attribute *attr,
 			     char *buf)
 {
-	struct foo_attribute *attribute;
+	const struct foo_attribute *attribute;
 	struct foo_obj *foo;
 
 	attribute = to_foo_attr(attr);
@@ -73,7 +74,7 @@ static ssize_t foo_attr_store(struct kobject *kobj,
 			      struct attribute *attr,
 			      const char *buf, size_t len)
 {
-	struct foo_attribute *attribute;
+	const struct foo_attribute *attribute;
 	struct foo_obj *foo;
 
 	attribute = to_foo_attr(attr);
@@ -109,13 +110,13 @@ static void foo_release(struct kobject *kobj)
 /*
  * The "foo" file where the .foo variable is read from and written to.
  */
-static ssize_t foo_show(struct foo_obj *foo_obj, struct foo_attribute *attr,
+static ssize_t foo_show(struct foo_obj *foo_obj, const struct foo_attribute *attr,
 			char *buf)
 {
 	return sysfs_emit(buf, "%d\n", foo_obj->foo);
 }
 
-static ssize_t foo_store(struct foo_obj *foo_obj, struct foo_attribute *attr,
+static ssize_t foo_store(struct foo_obj *foo_obj, const struct foo_attribute *attr,
 			 const char *buf, size_t count)
 {
 	int ret;
@@ -128,14 +129,14 @@ static ssize_t foo_store(struct foo_obj *foo_obj, struct foo_attribute *attr,
 }
 
 /* Sysfs attributes cannot be world-writable. */
-static struct foo_attribute foo_attribute =
+static const struct foo_attribute foo_attribute =
 	__ATTR(foo, 0664, foo_show, foo_store);
 
 /*
  * More complex function where we determine which variable is being accessed by
  * looking at the attribute for the "baz" and "bar" files.
  */
-static ssize_t b_show(struct foo_obj *foo_obj, struct foo_attribute *attr,
+static ssize_t b_show(struct foo_obj *foo_obj, const struct foo_attribute *attr,
 		      char *buf)
 {
 	int var;
@@ -147,7 +148,7 @@ static ssize_t b_show(struct foo_obj *foo_obj, struct foo_attribute *attr,
 	return sysfs_emit(buf, "%d\n", var);
 }
 
-static ssize_t b_store(struct foo_obj *foo_obj, struct foo_attribute *attr,
+static ssize_t b_store(struct foo_obj *foo_obj, const struct foo_attribute *attr,
 		       const char *buf, size_t count)
 {
 	int var, ret;
@@ -163,16 +164,16 @@ static ssize_t b_store(struct foo_obj *foo_obj, struct foo_attribute *attr,
 	return count;
 }
 
-static struct foo_attribute baz_attribute =
+static const struct foo_attribute baz_attribute =
 	__ATTR(baz, 0664, b_show, b_store);
-static struct foo_attribute bar_attribute =
+static const struct foo_attribute bar_attribute =
 	__ATTR(bar, 0664, b_show, b_store);
 
 /*
  * Create a group of attributes so that we can create and destroy them all
  * at once.
  */
-static struct attribute *foo_default_attrs[] = {
+static const struct attribute *const foo_default_attrs[] = {
 	&foo_attribute.attr,
 	&baz_attribute.attr,
 	&bar_attribute.attr,
@@ -180,7 +181,7 @@ static struct attribute *foo_default_attrs[] = {
 };
 
 static umode_t foo_default_attrs_is_visible(struct kobject *kobj,
-					    struct attribute *attr,
+					    const struct attribute *attr,
 					    int n)
 {
 	/* Hide attributes with the same name as the kobject. */
@@ -190,8 +191,8 @@ static umode_t foo_default_attrs_is_visible(struct kobject *kobj,
 }
 
 static const struct attribute_group foo_default_group = {
-	.attrs		= foo_default_attrs,
-	.is_visible	= foo_default_attrs_is_visible,
+	.attrs_new	= foo_default_attrs,
+	.is_visible_new	= foo_default_attrs_is_visible,
 };
 __ATTRIBUTE_GROUPS(foo_default);
 

-- 
2.48.1

Re: [PATCH 1/6] sysfs: attribute_group: allow registration of const attribute

[Greg Kroah-Hartman]

On Thu, Jan 16, 2025 at 06:32:27PM +0100, Thomas Weißschuh wrote:
> To be able to constify instances of struct attribute it has to be
> possible to add them to struct attribute_group.
> The current type of the attrs member however is not compatible with that.
> Introduce a union that allows registration of both const and non-const
> attributes to enable a piecewise transition.
> As both union member types are compatible no logic needs to be adapted.
> 
> Technically it is now possible register a const struct
> attribute and receive it as mutable pointer in the callbacks.
> This is a soundness issue.
> But this same soundness issue already exists today in
> sysfs_create_file().
> Also the struct definition and callback implementation are always
> closely linked and are meant to be moved to const in lockstep.
> 
> Similar to commit 906c508afdca ("sysfs: attribute_group: allow registration of const bin_attribute")
> 
> Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
> ---
>  include/linux/sysfs.h | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
> index 0f2fcd244523f050c5286f19d4fe1846506f9214..f5e25bed777a6a6e717f10973f1abcd12111f5c5 100644
> --- a/include/linux/sysfs.h
> +++ b/include/linux/sysfs.h
> @@ -105,7 +105,10 @@ struct attribute_group {
>  	size_t			(*bin_size)(struct kobject *,
>  					    const struct bin_attribute *,
>  					    int);
> -	struct attribute	**attrs;
> +	union {
> +		struct attribute	**attrs;
> +		const struct attribute	*const *attrs_new;
> +	};

I'm all for the idea, BUT, let's finish up doing this one:

>  	union {
>  		struct bin_attribute		**bin_attrs;
>  		const struct bin_attribute	*const *bin_attrs_new;

first please.

That way we can see just how "easy" the switch from _new to not-new goes :)

thanks,

greg k-h

Re: [PATCH 1/6] sysfs: attribute_group: allow registration of const attribute

[Thomas Weißschuh]

Hi Greg,

On 2025-01-17 08:01:00+0100, Greg Kroah-Hartman wrote:
> On Thu, Jan 16, 2025 at 06:32:27PM +0100, Thomas Weißschuh wrote:
> > To be able to constify instances of struct attribute it has to be
> > possible to add them to struct attribute_group.
> > The current type of the attrs member however is not compatible with that.
> > Introduce a union that allows registration of both const and non-const
> > attributes to enable a piecewise transition.
> > As both union member types are compatible no logic needs to be adapted.
> > 
> > Technically it is now possible register a const struct
> > attribute and receive it as mutable pointer in the callbacks.
> > This is a soundness issue.
> > But this same soundness issue already exists today in
> > sysfs_create_file().
> > Also the struct definition and callback implementation are always
> > closely linked and are meant to be moved to const in lockstep.
> > 
> > Similar to commit 906c508afdca ("sysfs: attribute_group: allow registration of const bin_attribute")
> > 
> > Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
> > ---
> >  include/linux/sysfs.h | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> > 
> > diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
> > index 0f2fcd244523f050c5286f19d4fe1846506f9214..f5e25bed777a6a6e717f10973f1abcd12111f5c5 100644
> > --- a/include/linux/sysfs.h
> > +++ b/include/linux/sysfs.h
> > @@ -105,7 +105,10 @@ struct attribute_group {
> >  	size_t			(*bin_size)(struct kobject *,
> >  					    const struct bin_attribute *,
> >  					    int);
> > -	struct attribute	**attrs;
> > +	union {
> > +		struct attribute	**attrs;
> > +		const struct attribute	*const *attrs_new;
> > +	};
> 
> I'm all for the idea, BUT, let's finish up doing this one:
> 
> >  	union {
> >  		struct bin_attribute		**bin_attrs;
> >  		const struct bin_attribute	*const *bin_attrs_new;
> 
> first please.
> 
> That way we can see just how "easy" the switch from _new to not-new goes :)

I'd like to resend these preparatory patches so they go into v6.17-rc1
and I can work on the follow-up changes.
In my opinion the switch from _new will work nicely. There have been no
new users of _new in -next at all.

Any objections?


Thomas

Re: [PATCH 1/6] sysfs: attribute_group: allow registration of const attribute

[Greg Kroah-Hartman]

On Sat, Jun 28, 2025 at 10:19:07AM +0200, Thomas Weißschuh wrote:
> Hi Greg,
> 
> On 2025-01-17 08:01:00+0100, Greg Kroah-Hartman wrote:
> > On Thu, Jan 16, 2025 at 06:32:27PM +0100, Thomas Weißschuh wrote:
> > > To be able to constify instances of struct attribute it has to be
> > > possible to add them to struct attribute_group.
> > > The current type of the attrs member however is not compatible with that.
> > > Introduce a union that allows registration of both const and non-const
> > > attributes to enable a piecewise transition.
> > > As both union member types are compatible no logic needs to be adapted.
> > > 
> > > Technically it is now possible register a const struct
> > > attribute and receive it as mutable pointer in the callbacks.
> > > This is a soundness issue.
> > > But this same soundness issue already exists today in
> > > sysfs_create_file().
> > > Also the struct definition and callback implementation are always
> > > closely linked and are meant to be moved to const in lockstep.
> > > 
> > > Similar to commit 906c508afdca ("sysfs: attribute_group: allow registration of const bin_attribute")
> > > 
> > > Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
> > > ---
> > >  include/linux/sysfs.h | 5 ++++-
> > >  1 file changed, 4 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
> > > index 0f2fcd244523f050c5286f19d4fe1846506f9214..f5e25bed777a6a6e717f10973f1abcd12111f5c5 100644
> > > --- a/include/linux/sysfs.h
> > > +++ b/include/linux/sysfs.h
> > > @@ -105,7 +105,10 @@ struct attribute_group {
> > >  	size_t			(*bin_size)(struct kobject *,
> > >  					    const struct bin_attribute *,
> > >  					    int);
> > > -	struct attribute	**attrs;
> > > +	union {
> > > +		struct attribute	**attrs;
> > > +		const struct attribute	*const *attrs_new;
> > > +	};
> > 
> > I'm all for the idea, BUT, let's finish up doing this one:
> > 
> > >  	union {
> > >  		struct bin_attribute		**bin_attrs;
> > >  		const struct bin_attribute	*const *bin_attrs_new;
> > 
> > first please.
> > 
> > That way we can see just how "easy" the switch from _new to not-new goes :)
> 
> I'd like to resend these preparatory patches so they go into v6.17-rc1
> and I can work on the follow-up changes.
> In my opinion the switch from _new will work nicely. There have been no
> new users of _new in -next at all.
> 
> Any objections?

Sure, please do.

greg k-h