Re: [PATCH v3 3/3] integer-wrap: Force full rebuild when .scl file changes

Justin Stitt
2025-05-05T18:18:49Z

On Mon, May 5, 2025 at 11:16 AM Justin Stitt <justinstitt@google.com> wrote:
>
> On Sat, May 3, 2025 at 11:46 AM Kees Cook <kees@kernel.org> wrote:
> >
> > Since the integer wrapping sanitizer's behavior depends on its associated
> > .scl file, we must force a full rebuild if the file changes. If not,
> > instrumentation may differ between targets based on when they were built.
> >
> > Generate a new header file, integer-wrap.h, any time the Clang .scl
> > file changes. Include the header file in compiler-version.h when its
> > associated feature name, INTEGER_WRAP, is defined. This will be picked
> > up by fixdep and force rebuilds where needed.
> >
> > Signed-off-by: Kees Cook <kees@kernel.org>
> > ---
> > Cc: Masahiro Yamada <masahiroy@kernel.org>
> > Cc: Justin Stitt <justinstitt@google.com>
> > Cc: Nathan Chancellor <nathan@kernel.org>
> > Cc: Nicolas Schier <nicolas.schier@linux.dev>
> > Cc: Marco Elver <elver@google.com>
> > Cc: Andrey Konovalov <andreyknvl@gmail.com>
> > Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
> > Cc: <linux-kbuild@vger.kernel.org>
> > Cc: <kasan-dev@googlegroups.com>
> > Cc: <linux-hardening@vger.kernel.org>
> > ---
> > include/linux/compiler-version.h | 3 +++
> > scripts/Makefile.ubsan | 1 +
> > scripts/basic/Makefile | 5 +++++
> > 3 files changed, 9 insertions(+)
> >
> > diff --git a/include/linux/compiler-version.h b/include/linux/compiler-version.h
> > index 69b29b400ce2..187e749f9e79 100644
> > --- a/include/linux/compiler-version.h
> > +++ b/include/linux/compiler-version.h
> > @@ -19,3 +19,6 @@
> > #ifdef RANDSTRUCT
> > #include <generated/randstruct_hash.h>
> > #endif
> > +#ifdef INTEGER_WRAP
> > +#include <generated/integer-wrap.h>
> > +#endif
> > diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan
> > index 9e35198edbf0..653f7117819c 100644
> > --- a/scripts/Makefile.ubsan
> > +++ b/scripts/Makefile.ubsan
> > @@ -15,6 +15,7 @@ ubsan-cflags-$(CONFIG_UBSAN_TRAP) += $(call cc-option,-fsanitize-trap=undefined
> > export CFLAGS_UBSAN := $(ubsan-cflags-y)
> >
> > ubsan-integer-wrap-cflags-$(CONFIG_UBSAN_INTEGER_WRAP) += \
> > + -DINTEGER_WRAP \
> > -fsanitize-undefined-ignore-overflow-pattern=all \
> > -fsanitize=signed-integer-overflow \
> > -fsanitize=unsigned-integer-overflow \
> > diff --git a/scripts/basic/Makefile b/scripts/basic/Makefile
> > index dd289a6725ac..fb8e2c38fbc7 100644
> > --- a/scripts/basic/Makefile
> > +++ b/scripts/basic/Makefile
> > @@ -14,3 +14,8 @@ cmd_create_randstruct_seed = \
> > $(obj)/randstruct.seed: $(gen-randstruct-seed) FORCE
> > $(call if_changed,create_randstruct_seed)
> > always-$(CONFIG_RANDSTRUCT) += randstruct.seed
> > +
> > +# integer-wrap: if the .scl file changes, we need to do a full rebuild.
> > +$(obj)/../../include/generated/integer-wrap.h: $(srctree)/scripts/integer-wrap-ignore.scl FORCE
> > + $(call if_changed,touch)
> > +always-$(CONFIG_UBSAN_INTEGER_WRAP) += ../../include/generated/integer-wrap.h
>
> I'm not sure how this fake header stuff works to ensure builds deps
> are tracked properly but we do need scl files to be considered as part
> of complete builds, so:

As in, I'm sure it works but have personally never written or reviewed
a Makefile+generated header snippet like that before :)

>
> Acked-by: Justin Stitt <justinstitt@google.com>
>
> > --
> > 2.34.1
> >