Commit 81cee916 authored by Kees Cook's avatar Kees Cook
Browse files

compiler_types: Introduce __flex_counter() and family 

Introduce __flex_counter() which wraps __builtin_counted_by_ref(),
as newly introduced by GCC[1] and Clang[2]. Use of __flex_counter()
allows access to the counter member of a struct's flexible array member
when it has been annotated with __counted_by().

Introduce typeof_flex_counter(), overflows_flex_counter_type(), and
__set_flex_counter() to provide the needed _Generic() wrappers to get
sane results out of __flex_counter().

For example, with:

	struct foo {
		int counter;
		short array[] __counted_by(counter);
	} *p;

__flex_counter(p->array) will resolve to: &p->counter

typeof_flex_counter(p->array) will resolve to "int". (If p->array was not
annotated, it would resolve to "size_t".)

overflows_flex_counter_type(typeof(*p), array, COUNT) is the same as:

	COUNT <= type_max(p->counter) && COUNT >= type_min(p->counter)

(If p->array was not annotated it would return true since everything
fits in size_t.)

__set_flex_counter(p->array, COUNT) is the same as:

	p->counter = COUNT;

(It is a no-op if p->array is not annotated with __counted_by().)

Link: https://patch.msgid.link/20251203233036.3212363-3-kees@kernel.org


Signed-off-by: default avatarKees Cook <kees@kernel.org>
parent 070580b0

include/linux/compiler_types.h

+31 −0
Original line number Diff line number Diff line
@@ -535,6 +535,37 @@ struct ftrace_likely_data { 
#define __annotated(var, attr)	__builtin_has_attribute(var, attr)

#endif



/*

 * Optional: only supported since gcc >= 15, clang >= 19

 *

 *   gcc: https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html#index-_005f_005fbuiltin_005fcounted_005fby_005fref

 * clang: https://clang.llvm.org/docs/LanguageExtensions.html#builtin-counted-by-ref

 */

#if __has_builtin(__builtin_counted_by_ref)

/**

 * __flex_counter() - Get pointer to counter member for the given

 *                    flexible array, if it was annotated with __counted_by()

 * @FAM: Pointer to flexible array member of an addressable struct instance

 *

 * For example, with:

 *

 *	struct foo {

 *		int counter;

 *		short array[] __counted_by(counter);

 *	} *p;

 *

 * __flex_counter(p->array) will resolve to &p->counter.

 *

 * Note that Clang may not allow this to be assigned to a separate

 * variable; it must be used directly.

 *

 * If p->array is unannotated, this returns (void *)NULL.

 */

#define __flex_counter(FAM)	__builtin_counted_by_ref(FAM)

#else

#define __flex_counter(FAM)	((void *)NULL)

#endif



/*

 * Some versions of gcc do not mark 'asm goto' volatile:

 *

include/linux/overflow.h

+42 −0
Original line number Diff line number Diff line
@@ -552,4 +552,46 @@ static inline size_t __must_check size_sub(size_t minuend, size_t subtrahend) 
	(__member_size((name)->array) / sizeof(*(name)->array) +			\

						__must_be_array((name)->array))



/**

 * typeof_flex_counter() - Return the type of the counter variable of a given

 *                         flexible array member annotated by __counted_by().

 * @FAM: Instance of flexible array member within a given struct.

 *

 * Returns: "size_t" if no annotation exists.

 */

#define typeof_flex_counter(FAM)				\

	typeof(_Generic(__flex_counter(FAM),			\

			void *: (size_t)0,			\

			default: *__flex_counter(FAM)))



/**

 * overflows_flex_counter_type() - Check if the counter associated with the

 *				   given flexible array member can represent

 *				   a value.

 * @TYPE: Type of the struct that contains the @FAM.

 * @FAM: Member name of the FAM within @TYPE.

 * @COUNT: Value to check against the __counted_by annotated @FAM's counter.

 *

 * Returns: true if @COUNT can be represented in the @FAM's counter. When

 * @FAM is not annotated with __counted_by(), always returns true.

 */

#define overflows_flex_counter_type(TYPE, FAM, COUNT)		\

	(!overflows_type(COUNT, typeof_flex_counter(((TYPE *)NULL)->FAM)))



/**

 * __set_flex_counter() - Set the counter associated with the given flexible

 *                        array member that has been annoated by __counted_by().

 * @FAM: Instance of flexible array member within a given struct.

 * @COUNT: Value to store to the __counted_by annotated @FAM_PTR's counter.

 *

 * This is a no-op if no annotation exists. Count needs to be checked with

 * overflows_flex_counter_type() before using this function.

 */

#define __set_flex_counter(FAM, COUNT)				\

({								\

	*_Generic(__flex_counter(FAM),				\

		  void *:  &(size_t){ 0 },			\

		  default: __flex_counter(FAM)) = (COUNT);	\

})



#endif /* __LINUX_OVERFLOW_H */