From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f202.google.com (mail-pg1-f202.google.com [209.85.215.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3659C2D5937 for ; Wed, 14 Jan 2026 19:37:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768419447; cv=none; b=tdpbRF6i6BOLS0Z67UrBylIfWlLc651OyZ+pAeirJ5bL1Ay0sJlxzjj6P3AXaUFYoXFx+QLLODBMHsDlsKdz9KEXWt7c8R6VXRMjqLdDfU0Fhz0dTgC1pnXhIAc3gzTjJTHI40FtVvJRvSDmE/MJVxTns9vkSI4V+9M4x1cTisc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768419447; c=relaxed/simple; bh=EQdSM0yOXS8C3leRvmeb2QGrjb/3aaIMy7AzLXYJTsQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: Cc:Content-Type; b=L8yfaPqA17e5Hgmi9HO6wjyOIvOLk806jjqQWNvi43ebBND9TggdUsV5s4tZ12zPZNOjxszkiojgR+jyjj71bFzXUgAgqT67fBsX/i+eJQ0PlmDtan/nGbZNJxayuwRNcBwlgc5TYLNuWAm/vqwt/tEK0pww1scppJhp8JcqJGE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--morbo.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=A85gEP9+; arc=none smtp.client-ip=209.85.215.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--morbo.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="A85gEP9+" Received: by mail-pg1-f202.google.com with SMTP id 41be03b00d2f7-c52743b781eso93963a12.2 for ; Wed, 14 Jan 2026 11:37:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1768419445; x=1769024245; darn=lists.linux.dev; h=content-transfer-encoding:cc:from:subject:message-id:references :mime-version:in-reply-to:date:from:to:cc:subject:date:message-id :reply-to; bh=PJ1Oy9t9P+wnGwZGZn0q3AykJg67xBsGj9QaYqlCMiU=; b=A85gEP9+fbb0jOiujM2W3zgOpjBPubcYQxVfBrT40ybdJ7rku0WsiGUtG4Samxd05h gY4uYnIqyhl2AoaRa9slCe4VE7DrdD6FH6/EBhB19RusIal9Gd1lZyYo7ZItNSXLSFVa CbGiL/HR100/5K6c6mWtnXs+XxxLpCkl5Y8jHbpdATeQ/XxC1rffD1pGr6sy19IIVxrG k8UIdXm7sRa3I1zmqSKz7G/XQ0DbiF2Hg/SGENP3NtKKj8NuFgX4LkSOOCMIan8pofA8 oKXZPFVWO6eGJrns2WUnoWxq2VgxVnZzlYqtydX+2jHIuWE9RaB4mWM/qpPvpss0FzOM csRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768419445; x=1769024245; h=content-transfer-encoding:cc:from:subject:message-id:references :mime-version:in-reply-to:date:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=PJ1Oy9t9P+wnGwZGZn0q3AykJg67xBsGj9QaYqlCMiU=; b=XLSC/S9RkfAEGwjwAQRaalUqpSByK7WMkPb6HhB64nwCgjuQlzriIp4onUxPtATrru YJQYh2JpJwTb5npOdXuetoXUPxnmn9+BygwHYwAXQ2FfQmloBXB2eMEkOZHL63i0BhSd mQfB/ECFsbXWY/98toqLJ8wXS8YGr2ZwrmMNN+CoSJJtAA+L/SfCViSWnqRJk6CtBnUo Hx1BIEXHyB7/lVAguBVNRBlSy+/2KY0fw4fK6zuhKxPcLNbJ21VVOUtYlpKtCUIkr9PB Do4QjPYztEqjDcM/eJLpopwImGRETgmNSXfYzUukfH6FjgyhZPZf447jCWu4fj7l9XfW 4MfQ== X-Forwarded-Encrypted: i=1; AJvYcCUHxjNi7ZBEMZACnFwyKyKEKWKDP6ibqijrq6m4m5TnrTwohtC0bJ9KLhSQS/b7iDFsto46@lists.linux.dev X-Gm-Message-State: AOJu0Yy/Epyu8+B18mDOJk4vFSJU0R9Y1hJuT/2Z12YM/0lUPLzM6bvr JjwsOzK4ntgCGHKe/nYxo2fFo4uUDl1OG7AQDtcJ+ur9UNrV17W1SwXZtn7VWD6qPyFAy31ZnHR i X-Received: from pgnd16.prod.google.com ([2002:a63:7350:0:b0:bfe:d576:aabd]) (user=morbo job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:7f97:b0:38b:d95d:efd7 with SMTP id adf61e73a8af0-38bed1b9f0emr4607629637.44.1768419445289; Wed, 14 Jan 2026 11:37:25 -0800 (PST) Date: Wed, 14 Jan 2026 19:36:47 +0000 In-Reply-To: <20251121195504.1661783-1-morbo@google.com> Precedence: bulk X-Mailing-List: llvm@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20251121195504.1661783-1-morbo@google.com> X-Mailer: git-send-email 2.52.0.457.g6b5491de43-goog Message-ID: <20260114193716.1740684-1-morbo@google.com> Subject: [PATCH 1/2] Compiler Attributes: Add __counted_by_ptr macro From: Bill Wendling Cc: Bill Wendling , Kees Cook , "Gustavo A. R. Silva" , Nathan Chancellor , Nick Desaulniers , Justin Stitt , Miguel Ojeda , Peter Zijlstra , Andrew Morton , Heiko Carstens , Marc Herbert , Uros Bizjak , Tejun Heo , Jeff Xu , "=?UTF-8?q?Michal=20Koutn=C3=BD?=" , Shakeel Butt , "=?UTF-8?q?Thomas=20Wei=C3=9Fschuh?=" , John Stultz , Christian Brauner , Randy Dunlap , Brian Gerst , Masahiro Yamada , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, llvm@lists.linux.dev, Nicolas Schier , Tamir Duberstein , Steven Rostedt , "Jason A. Donenfeld" , "H. Peter Anvin" , Naman Jain , Eric Dumazet , Simon Horman , Jakub Kicinski , Paolo Abeni , Ingo Molnar , Thomas Gleixner , Douglas Anderson , linux-kbuild@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Introduce __counted_by_ptr(), which works like __counted_by(), but for pointer struct members. struct foo { int a, b, c; char *buffer __counted_by_ptr(bytes); short nr_bars; struct bar *bars __counted_by_ptr(nr_bars); size_t bytes; }; Because "counted_by" can only be applied to pointer members in very recent compiler versions, its application ends up needing to be distinct from flexibe array "counted_by" annotations, hence a separate macro. Note that Clang's support for "void *" members will be in version 22. So, when using Clang, you'll need to wait until its release before using the feature with "void *". No such restriction applies to GCC's version 16. This is a reworking of Kees' previous patch [1]. Link: https://lore.kernel.org/all/20251020220118.1226740-1-kees@kernel.org/= [1] Co-developed-by: Kees Cook Signed-off-by: Bill Wendling --- Cc: Kees Cook Cc: "Gustavo A. R. Silva" Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Justin Stitt Cc: Miguel Ojeda Cc: Peter Zijlstra Cc: Andrew Morton Cc: Heiko Carstens Cc: Marc Herbert Cc: Uros Bizjak Cc: Tejun Heo Cc: Jeff Xu Cc: "Michal Koutn=C3=BD" Cc: Shakeel Butt Cc: "Thomas Wei=C3=9Fschuh" Cc: John Stultz Cc: Christian Brauner Cc: Randy Dunlap Cc: Brian Gerst Cc: Masahiro Yamada Cc: linux-kernel@vger.kernel.org Cc: linux-hardening@vger.kernel.org Cc: llvm@lists.linux.dev --- v3 - Replace the previous code with a modified version of Kees' previous pa= tch [1]. - The question about the naming of the macro was considered, but we deci= ded to keep the original naming (__counted_by_ptr), because it mirrors the= current macros like "__counted_by_{le,be}". v2 - Add support for GCC. --- Makefile | 6 ++++++ include/linux/compiler_types.h | 18 +++++++++++++++++- include/uapi/linux/stddef.h | 4 ++++ init/Kconfig | 7 +++++++ 4 files changed, 34 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 9d38125263fb..6b029f694bc2 100644 --- a/Makefile +++ b/Makefile @@ -952,6 +952,12 @@ KBUILD_CFLAGS +=3D $(CC_AUTO_VAR_INIT_ZERO_ENABLER) endif endif =20 +ifdef CONFIG_CC_IS_CLANG +ifdef CONFIG_CC_HAS_COUNTED_BY_PTR +KBUILD_CFLAGS +=3D -fexperimental-late-parse-attributes +endif +endif + # Explicitly clear padding bits during variable initialization KBUILD_CFLAGS +=3D $(call cc-option,-fzero-init-padding-bits=3Dall) =20 diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.= h index d3318a3c2577..e597c814d60b 100644 --- a/include/linux/compiler_types.h +++ b/include/linux/compiler_types.h @@ -369,7 +369,7 @@ struct ftrace_likely_data { * Optional: only supported since clang >=3D 18 * * gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D108896 - * clang: https://github.com/llvm/llvm-project/pull/76348 + * clang: https://clang.llvm.org/docs/AttributeReference.html#counted-by-c= ounted-by-or-null-sized-by-sized-by-or-null * * __bdos on clang < 19.1.2 can erroneously return 0: * https://github.com/llvm/llvm-project/pull/110497 @@ -383,6 +383,22 @@ struct ftrace_likely_data { # define __counted_by(member) #endif =20 +/* + * Runtime track number of objects pointed to by a pointer member for use = by + * CONFIG_FORTIFY_SOURCE and CONFIG_UBSAN_BOUNDS. + * + * Optional: only supported since gcc >=3D 16 + * Optional: only supported since clang >=3D 21.1 + * + * gcc: https://gcc.gnu.org/pipermail/gcc-patches/2025-April/681727.html + * clang: https://github.com/llvm/llvm-project/pull/137250 + */ +#ifdef CONFIG_CC_HAS_COUNTED_BY_PTR +#define __counted_by_ptr(member) __attribute__((__counted_by__(member))) +#else +#define __counted_by_ptr(member) +#endif + /* * Optional: only supported since gcc >=3D 15 * Optional: not supported by Clang diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h index 9a28f7d9a334..111b097ec00b 100644 --- a/include/uapi/linux/stddef.h +++ b/include/uapi/linux/stddef.h @@ -72,6 +72,10 @@ #define __counted_by_be(m) #endif =20 +#ifndef __counted_by_ptr +#define __counted_by_ptr(m) +#endif + #ifdef __KERNEL__ #define __kernel_nonstring __nonstring #else diff --git a/init/Kconfig b/init/Kconfig index fa79feb8fe57..dc27b998d111 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -143,6 +143,13 @@ config CC_HAS_COUNTED_BY # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D108896 default y if CC_IS_GCC && GCC_VERSION >=3D 150100 =20 +config CC_HAS_COUNTED_BY_PTR + bool + # supported since clang 21.1.0 + default y if CC_IS_CLANG && CLANG_VERSION >=3D 210100 + # supported since gcc 16.0.0 + default y if CC_IS_GCC && GCC_VERSION >=3D 160000 + config CC_HAS_MULTIDIMENSIONAL_NONSTRING def_bool $(success,echo 'char tag[][4] __attribute__((__nonstring__)) =3D= { };' | $(CC) $(CLANG_FLAGS) -x c - -c -o /dev/null -Werror) =20 --=20 2.52.0.457.g6b5491de43-goog