On Mon, Feb 24, 2020 at 04:34:59PM +0100, gli...@google.com wrote:
> For CONFIG_INIT_STACK_ALL it's sometimes handy to disable
> force-initialization for a local variable, if it is known to be initialized
> later on before the first use. This can be done by using the
> __do_not_initialize macro.
Nit-pick: other things are listed as __no_$feature. What about naming
this __no_initialize (or reuse the attribute name of __uninitialized)?
> __do_not_initialize should be applied carefully, as future changes to
> the code around the local variable may introduce paths on which the
> variable remains uninitialized before the use.
>
> Signed-off-by: Alexander Potapenko <gli...@google.com>
Please CC lkml as well in the future.
But yes, this seems like a reasonable work-around until compilers can be
taught which functions are considered initialization sinks. :)
-Kees
> ---
> include/linux/compiler-clang.h | 10 ++++++++++
> include/linux/compiler_types.h | 4 ++++
> 2 files changed, 14 insertions(+)
>
> diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
> index 333a6695a918c..9204334d39261 100644
> --- a/include/linux/compiler-clang.h
> +++ b/include/linux/compiler-clang.h
> @@ -24,6 +24,16 @@
> #define __no_sanitize_address
> #endif
>
> +/*
> + * Disable initialization of a local variable when building with
> + * CONFIG_INIT_STACK_ALL.
> + */
> +#ifdef CONFIG_INIT_STACK_ALL
> +#define __do_not_initialize __attribute__((uninitialized))
> +#else
> +#define __do_not_initialize
> +#endif
> +
> /*
> * Not all versions of clang implement the the type-generic versions
> * of the builtin overflow checkers. Fortunately, clang implements
> diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
> index 72393a8c1a6c5..b216beb5586fc 100644
> --- a/include/linux/compiler_types.h
> +++ b/include/linux/compiler_types.h
> @@ -180,6 +180,10 @@ struct ftrace_likely_data {
>
> #endif /* __ASSEMBLY__ */
>
> +#ifndef __do_not_initialize
> +#define __do_not_initialize
> +#endif
> +
> /*
> * The below symbols may be defined for one or more, but not ALL, of the
> above
> * compilers. We don't consider that to be an error, so set them to nothing.
> --
> 2.25.0.265.gbab2e86ba0-goog
>
--
Kees Cook
_______________________________________________
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
