From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AG47ELtjtUn7pXmMUo33SsHSEu+0W9xpJQL4ayGcgRUObKiasO7M435bLAGkeZobM9Q9Z5tzCkxq ARC-Seal: i=1; a=rsa-sha256; t=1521209757; cv=none; d=google.com; s=arc-20160816; b=ZGcrbR77ML+kS2/Q3VBOtdpf5VV9z2QFUecCSQwuwj7GqD+RMl1RadGwBjbR+UHdez P0M+Ewl6gQ3MOwBqRm/8R8gKUIrfPm+8hmCbBhvcVGleHnVLHHk9MgBoyS+OnV2eaHM5 4h30BVDEugil7oeaeUu6iTT5BMYodBEvOzFyQxVm6HM4np1do4Tl2vxzrfAepJFFlDW2 sdlsq/pWIwTqWrSJYXipl0IEk+aFxHmC/6gBN49bOrUgOBIYcX+sLW+7zPzPzEFa/m7t S6jP82p6Z8Bf+QPMGiqwwj4aQ13PlJtKih2dmMSCrgHZaWJJjR4MlGxS5puRgrcUW+Ic mQ9A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:content-language:in-reply-to:mime-version :user-agent:date:message-id:from:references:cc:to:subject :dkim-signature:delivered-to:list-id:list-subscribe:list-unsubscribe :list-help:list-post:precedence:mailing-list :arc-authentication-results; bh=ibzdMPap/Yli+F4nDQEw4s0WyrAu66mEZmIXZMqG2sw=; b=nTM0x9shk0yTDVtFNPXPs8zhS9IYvfbDg6jzOY/G+lNsnqy9vvNcec6jvKFP4V4uZJ LGQl9+lvaIUSXFZg2fXgSbFg3BaQEHlRdUimApqo2/NYBOTzmZCxyA1+2fh2LAS3WiJC HkpcAkwChip0t/0ujYNpAfHwYiJide/hmurFiDJpr1XG9kxg3q9YlNJ/lMW5q/d8A/5x IoCOxw05ofFPvK3njVkurkxZ6/MPHENmGk1t9JxLqLS0Vcl2e7przawtUmDXyfh7PziS lFo9eyYwSgvVZeOdk0lDc2dJ5hrc4dAPRyYFuDUlZCKyA5aw8k/tSP8lXMwPta8FI+Q6 HeuA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@rasmusvillemoes.dk header.s=google header.b=jT/mIyqH; spf=pass (google.com: domain of kernel-hardening-return-12663-gregkh=linuxfoundation.org@lists.openwall.com designates 195.42.179.200 as permitted sender) smtp.mailfrom=kernel-hardening-return-12663-gregkh=linuxfoundation.org@lists.openwall.com Authentication-Results: mx.google.com; dkim=pass header.i=@rasmusvillemoes.dk header.s=google header.b=jT/mIyqH; spf=pass (google.com: domain of kernel-hardening-return-12663-gregkh=linuxfoundation.org@lists.openwall.com designates 195.42.179.200 as permitted sender) smtp.mailfrom=kernel-hardening-return-12663-gregkh=linuxfoundation.org@lists.openwall.com Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm List-Post: List-Help: List-Unsubscribe: List-Subscribe: Subject: Re: [PATCH v4 1/2] kernel.h: Introduce const_max() for VLA removal To: Linus Torvalds , Kees Cook Cc: Andrew Morton , Josh Poimboeuf , Rasmus Villemoes , Randy Dunlap , Miguel Ojeda , Ingo Molnar , David Laight , Ian Abbott , linux-input , linux-btrfs , Network Development , Linux Kernel Mailing List , Kernel Hardening References: <1521143266-31350-1-git-send-email-keescook@chromium.org> <1521143266-31350-2-git-send-email-keescook@chromium.org> From: Rasmus Villemoes Message-ID: Date: Fri, 16 Mar 2018 15:15:34 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1595034361293703830?= X-GMAIL-MSGID: =?utf-8?q?1595104042670520668?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On 2018-03-16 00:46, Linus Torvalds wrote: > On Thu, Mar 15, 2018 at 4:41 PM, Kees Cook wrote: >> >> I much prefer explicit typing, but both you and Rasmus mentioned >> wanting the int/sizeof_t mixing. > > Well, the explicit typing allows that mixing, in that you can just > have "const_max_t(5,sizeof(x))" > > So I'm ok with that. > > What I'm *not* so much ok with is "const_max(5,sizeof(x))" erroring > out, or silently causing insane behavior due to hidden subtle type > casts.. I don't like const_max_t, at least not as the "primary" interface - forcing the user to pass in a type, or equivalently passing in cast expressions to a const_max(), can hide errors, e.g. if the -1 is really SOME_MACRO or some complicated expression that is usually positive, but that expression always gets cast to size_t because the user was forced to do const_max_t(size_t, SOME_MACRO, sizeof(foo)) to make the code compile. Not to mention that it's both easier to read and write if one could just do const_max(SOME_MACRO, sizeof(foo)) Can we instead do one of the following: (1) Effectively do the comparison in an infinitely wide signed integer, i.e. implement x < 0 && y >= 0 --> y x >= 0 && y < 0 --> x otherwise, if both have the same sign (but not necessarily the same signedness of their types), the type promotions do not alter either's value, so __builtin_choose_expr(x > y, x, y) will do the right thing with the resulting thing having the same type as the chosen one of x and y. [Or having type typeof(x+y), which would just be a cast in the macro.] This would allow const_max(-1, sizeof(foo)) and give sizeof(foo), but perhaps that's too magic. (2) Allow mixed types, but ensure the build fails if one of the values is not representable in typeof(x+y) (i.e., one value is negative but the common type is unsigned). That allows the const_max(SOME_MACRO, sizeof()), but prevents silent failure in case some weird combination of CONFIG options make SOME_MACRO evaluate to something negative. The user can always pass in (size_t)-1 explicitly if needed, or cast the sizeof() to int if that's what makes sense, but that's a case-by-case thing. I'd really like that the simple case const_max(16, sizeof(foo)) Just Works. Then if a lot users turn up that do need some casting, const_max_t can be implemented as a trivial const_max wrapper. Rasmus (1) something like __builtin_choose_expr((x >= 0 && y < 0) || \ (x >= 0 && y >= 0 && x > y) || \ (x < 0 && y < 0 && x > y), x, y) (2) something like // 1 or build error #define __check_promotion(t, x) ( 1/(((t)(x) < 0) == ((x) < 0)) ) __builtin_choose_expr(__check_promotion(typeof((x)+(y)), x) && \ __check_promotion(typeof((x)+(y)), y) && \ (x) > (y), x, y) Not sure how to get a more sensible error message, I'd like this to also work outside functions.