Unfortunately, just version checking the use of -Wno-alloc-size-larger-than
is not sufficient to make the __alloc_size attribute behave correctly
under older GCC versions. The attribute itself must be disabled in those
situations too, as there appears to be no way to reliably silence the
SIZE_MAX constant expression cases for GCC versions less than 9.1:
In file included from ./include/linux/resource_ext.h:11,
from ./include/linux/pci.h:40,
from drivers/net/ethernet/intel/ixgbe/ixgbe.h:9,
from drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c:4:
In function 'kmalloc_node',
inlined from 'ixgbe_alloc_q_vector' at ./include/linux/slab.h:743:9:
./include/linux/slab.h:618:9: error: argument 1 value '18446744073709551615' exceeds maximum object size 9223372036854775807 [-Werror=alloc-size-larger-than=]
return __kmalloc_node(size, flags, node);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./include/linux/slab.h: In function 'ixgbe_alloc_q_vector':
./include/linux/slab.h:455:7: note: in a call to allocation function '__kmalloc_node' declared here
void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_slab_alignment __malloc;
^~~~~~~~~~~~~~
Specifically:
-Wno-alloc-size-larger-than is not correctly handled by GCC < 9.1
https://godbolt.org/z/hqsfG7q84 (doesn't disable)
https://godbolt.org/z/P9jdrPTYh (doesn't admit to not knowing about option)
https://godbolt.org/z/465TPMWKb (only warns when other warnings appear)
-Walloc-size-larger-than=18446744073709551615 is not handled by GCC < 8.2
https://godbolt.org/z/73hh1EPxz (ignores numeric value)
Cc: Andrew Morton <[email protected]>
Cc: Miguel Ojeda <[email protected]>
Cc: Nathan Chancellor <[email protected]>
Cc: Marco Elver <[email protected]>
Cc: Will Deacon <[email protected]>
Cc: Arvind Sankar <[email protected]>
Cc: Masahiro Yamada <[email protected]>
Cc: "Peter Zijlstra (Intel)" <[email protected]>
Cc: Sami Tolvanen <[email protected]>
Cc: Arnd Bergmann <[email protected]>
Cc: Ard Biesheuvel <[email protected]>
Cc: [email protected]
Reviewed-by: Nick Desaulniers <[email protected]>
Signed-off-by: Kees Cook <[email protected]>
---
And now I've added GCC 4.9, 5, and 6 to my build configs... 4.9 is so
old I have to turn off RETPOLIN in defconfig. :P
v2:
- fix lack of VARARGS in fall-back macro
- add reviewed-by
---
include/linux/compiler-gcc.h | 9 +++++++++
include/linux/compiler_attributes.h | 6 ------
include/linux/compiler_types.h | 5 +++++
3 files changed, 14 insertions(+), 6 deletions(-)
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 01985821944b..3f3efbb651e0 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -151,3 +151,12 @@
#else
#define __diag_GCC_8(s)
#endif
+
+/*
+ * https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-alloc_005fsize-function-attribute
+ * However, prior to 9.1, -Wno-alloc-size-larger-than does not work,
+ * making this attribute unusable.
+ */
+#if GCC_VERSION < 90100
+#define __alloc_size(x, ...) /**/
+#endif
diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h
index 19f178e20e61..2487be0e7199 100644
--- a/include/linux/compiler_attributes.h
+++ b/include/linux/compiler_attributes.h
@@ -53,12 +53,6 @@
#define __aligned(x) __attribute__((__aligned__(x)))
#define __aligned_largest __attribute__((__aligned__))
-/*
- * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-alloc_005fsize-function-attribute
- * clang: https://clang.llvm.org/docs/AttributeReference.html#alloc-size
- */
-#define __alloc_size(x, ...) __attribute__((__alloc_size__(x, ## __VA_ARGS__)))
-
/*
* Note: users of __always_inline currently do not write "inline" themselves,
* which seems to be required by gcc to apply the attribute according
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index c43308b0a9a9..91de9bead40d 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -254,6 +254,11 @@ struct ftrace_likely_data {
#define asm_volatile_goto(x...) asm goto(x)
#endif
+/* If not specifically disabled, allow the use of __alloc_size attribute. */
+#ifndef __alloc_size
+# define __alloc_size(x, ...) __attribute__((__alloc_size__(x, ## __VA_ARGS__)))
+#endif
+
#ifdef CONFIG_CC_HAS_ASM_INLINE
#define asm_inline asm __inline
#else
--
2.30.2
On 9/10/2021 1:11 PM, Kees Cook wrote:
> Unfortunately, just version checking the use of -Wno-alloc-size-larger-than
> is not sufficient to make the __alloc_size attribute behave correctly
> under older GCC versions. The attribute itself must be disabled in those
> situations too, as there appears to be no way to reliably silence the
> SIZE_MAX constant expression cases for GCC versions less than 9.1:
>
> In file included from ./include/linux/resource_ext.h:11,
> from ./include/linux/pci.h:40,
> from drivers/net/ethernet/intel/ixgbe/ixgbe.h:9,
> from drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c:4:
> In function 'kmalloc_node',
> inlined from 'ixgbe_alloc_q_vector' at ./include/linux/slab.h:743:9:
> ./include/linux/slab.h:618:9: error: argument 1 value '18446744073709551615' exceeds maximum object size 9223372036854775807 [-Werror=alloc-size-larger-than=]
> return __kmalloc_node(size, flags, node);
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ./include/linux/slab.h: In function 'ixgbe_alloc_q_vector':
> ./include/linux/slab.h:455:7: note: in a call to allocation function '__kmalloc_node' declared here
> void *__kmalloc_node(size_t size, gfp_t flags, int node) __assume_slab_alignment __malloc;
> ^~~~~~~~~~~~~~
>
> Specifically:
> -Wno-alloc-size-larger-than is not correctly handled by GCC < 9.1
> https://godbolt.org/z/hqsfG7q84 (doesn't disable)
> https://godbolt.org/z/P9jdrPTYh (doesn't admit to not knowing about option)
> https://godbolt.org/z/465TPMWKb (only warns when other warnings appear)
>
> -Walloc-size-larger-than=18446744073709551615 is not handled by GCC < 8.2
> https://godbolt.org/z/73hh1EPxz (ignores numeric value)
>
> Cc: Andrew Morton <[email protected]>
> Cc: Miguel Ojeda <[email protected]>
> Cc: Nathan Chancellor <[email protected]>
> Cc: Marco Elver <[email protected]>
> Cc: Will Deacon <[email protected]>
> Cc: Arvind Sankar <[email protected]>
> Cc: Masahiro Yamada <[email protected]>
> Cc: "Peter Zijlstra (Intel)" <[email protected]>
> Cc: Sami Tolvanen <[email protected]>
> Cc: Arnd Bergmann <[email protected]>
> Cc: Ard Biesheuvel <[email protected]>
> Cc: [email protected]
> Reviewed-by: Nick Desaulniers <[email protected]>
> Signed-off-by: Kees Cook <[email protected]>
Reviewed-by: Nathan Chancellor <[email protected]>
One open-ended comment below.
> ---
> And now I've added GCC 4.9, 5, and 6 to my build configs... 4.9 is so
> old I have to turn off RETPOLIN in defconfig. :P
>
> v2:
> - fix lack of VARARGS in fall-back macro
> - add reviewed-by
> ---
> include/linux/compiler-gcc.h | 9 +++++++++
> include/linux/compiler_attributes.h | 6 ------
> include/linux/compiler_types.h | 5 +++++
> 3 files changed, 14 insertions(+), 6 deletions(-)
>
> diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
> index 01985821944b..3f3efbb651e0 100644
> --- a/include/linux/compiler-gcc.h
> +++ b/include/linux/compiler-gcc.h
> @@ -151,3 +151,12 @@
> #else
> #define __diag_GCC_8(s)
> #endif
> +
> +/*
> + * https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-alloc_005fsize-function-attribute
> + * However, prior to 9.1, -Wno-alloc-size-larger-than does not work,
> + * making this attribute unusable.
> + */
> +#if GCC_VERSION < 90100
> +#define __alloc_size(x, ...) /**/
> +#endif
> diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h
> index 19f178e20e61..2487be0e7199 100644
> --- a/include/linux/compiler_attributes.h
> +++ b/include/linux/compiler_attributes.h
> @@ -53,12 +53,6 @@
> #define __aligned(x) __attribute__((__aligned__(x)))
> #define __aligned_largest __attribute__((__aligned__))
>
> -/*
> - * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-alloc_005fsize-function-attribute
> - * clang: https://clang.llvm.org/docs/AttributeReference.html#alloc-size
It might be nice to keep a link to the clang documentation somewhere as
I like the example a little bit more but I guess it does not make sense
in compiler_types.h...
> - */
> -#define __alloc_size(x, ...) __attribute__((__alloc_size__(x, ## __VA_ARGS__)))
> -
> /*
> * Note: users of __always_inline currently do not write "inline" themselves,
> * which seems to be required by gcc to apply the attribute according
> diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
> index c43308b0a9a9..91de9bead40d 100644
> --- a/include/linux/compiler_types.h
> +++ b/include/linux/compiler_types.h
> @@ -254,6 +254,11 @@ struct ftrace_likely_data {
> #define asm_volatile_goto(x...) asm goto(x)
> #endif
>
> +/* If not specifically disabled, allow the use of __alloc_size attribute. */
> +#ifndef __alloc_size
> +# define __alloc_size(x, ...) __attribute__((__alloc_size__(x, ## __VA_ARGS__)))
> +#endif
> +
> #ifdef CONFIG_CC_HAS_ASM_INLINE
> #define asm_inline asm __inline
> #else
>