<!DOCTYPE html>
<html lang="en" data-content_root="../">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Deprecated Interfaces, Language Features, Attributes, and Conventions — The Linux Kernel documentation</title>
<link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="../_static/alabaster.css?v=3918102e" />
<script src="../_static/documentation_options.js?v=5929fcd5"></script>
<script src="../_static/doctools.js?v=9bcbadda"></script>
<script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="index" title="Index" href="../genindex.html" />
<link rel="search" title="Search" href="../search.html" />
<link rel="next" title="Core API Documentation" href="../core-api/index.html" />
<link rel="prev" title="Index of Further Kernel Documentation" href="kernel-docs.html" />
<link rel="stylesheet" href="../_static/custom.css" type="text/css" />
</head><body>
<div class="document">
<div class="sphinxsidebar" role="navigation" aria-label="Main">
<div class="sphinxsidebarwrapper">
<p class="logo"><a href="../index.html">
<img class="logo" src="../_static/logo.svg" alt="Logo of The Linux Kernel"/>
</a></p>
<h1 class="logo"><a href="../index.html">The Linux Kernel</a></h1>
<p class="blurb">6.18.50</p>
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="../search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
<p>
<h3 class="kernel-toc-contents">Contents</h3>
<input type="checkbox" class="kernel-toc-toggle" id = "kernel-toc-toggle" checked>
<label class="kernel-toc-title" for="kernel-toc-toggle"></label>
<div class="kerneltoc" id="kerneltoc">
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="development-process.html">Development process</a></li>
<li class="toctree-l1"><a class="reference internal" href="submitting-patches.html">Submitting patches</a></li>
<li class="toctree-l1"><a class="reference internal" href="code-of-conduct.html">Code of conduct</a></li>
<li class="toctree-l1"><a class="reference internal" href="../maintainer/index.html">Maintainer handbook</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="index.html">All development-process docs</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="index.html#an-introduction-to-how-kernel-development-works">An introduction to how kernel development works</a></li>
<li class="toctree-l2"><a class="reference internal" href="index.html#tools-and-technical-guides-for-kernel-developers">Tools and technical guides for kernel developers</a></li>
<li class="toctree-l2"><a class="reference internal" href="index.html#policy-guides-and-developer-statements">Policy guides and developer statements</a></li>
<li class="toctree-l2"><a class="reference internal" href="index.html#dealing-with-bugs">Dealing with bugs</a></li>
<li class="toctree-l2"><a class="reference internal" href="index.html#maintainer-information">Maintainer information</a></li>
<li class="toctree-l2 current"><a class="reference internal" href="index.html#other-material">Other material</a><ul class="current">
<li class="toctree-l3"><a class="reference internal" href="kernel-docs.html">Index of Further Kernel Documentation</a></li>
<li class="toctree-l3 current"><a class="current reference internal" href="#">Deprecated Interfaces, Language Features, Attributes, and Conventions</a></li>
</ul>
</li>
</ul>
</li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../core-api/index.html">Core API</a></li>
<li class="toctree-l1"><a class="reference internal" href="../driver-api/index.html">Driver APIs</a></li>
<li class="toctree-l1"><a class="reference internal" href="../subsystem-apis.html">Subsystems</a></li>
<li class="toctree-l1"><a class="reference internal" href="../locking/index.html">Locking</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="license-rules.html">Licensing rules</a></li>
<li class="toctree-l1"><a class="reference internal" href="../doc-guide/index.html">Writing documentation</a></li>
<li class="toctree-l1"><a class="reference internal" href="../dev-tools/index.html">Development tools</a></li>
<li class="toctree-l1"><a class="reference internal" href="../dev-tools/testing-overview.html">Testing guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../kernel-hacking/index.html">Hacking guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../trace/index.html">Tracing</a></li>
<li class="toctree-l1"><a class="reference internal" href="../fault-injection/index.html">Fault injection</a></li>
<li class="toctree-l1"><a class="reference internal" href="../livepatch/index.html">Livepatching</a></li>
<li class="toctree-l1"><a class="reference internal" href="../rust/index.html">Rust</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../admin-guide/index.html">Administration</a></li>
<li class="toctree-l1"><a class="reference internal" href="../kbuild/index.html">Build system</a></li>
<li class="toctree-l1"><a class="reference internal" href="../admin-guide/reporting-issues.html">Reporting issues</a></li>
<li class="toctree-l1"><a class="reference internal" href="../tools/index.html">Userspace tools</a></li>
<li class="toctree-l1"><a class="reference internal" href="../userspace-api/index.html">Userspace API</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../firmware-guide/index.html">Firmware</a></li>
<li class="toctree-l1"><a class="reference internal" href="../devicetree/index.html">Firmware and Devicetree</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../arch/index.html">CPU architectures</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../staging/index.html">Unsorted documentation</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../translations/index.html">Translations</a></li>
</ul>
</div>
<script type="text/javascript"> <!--
var sbar = document.getElementsByClassName("sphinxsidebar")[0];
let currents = document.getElementsByClassName("current")
if (currents.length) {
sbar.scrollTop = currents[currents.length - 1].offsetTop;
}
--> </script>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="../_sources/process/deprecated.rst.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
</div>
</div>
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<div class="language-selection">
English
<ul>
<li><a href="../translations/it_IT/process/deprecated.html">Italian</a></li>
<li><a href="../translations/sp_SP/process/deprecated.html">Spanish</a></li>
</ul>
</div>
<section id="deprecated-interfaces-language-features-attributes-and-conventions">
<span id="deprecated"></span><h1>Deprecated Interfaces, Language Features, Attributes, and Conventions<a class="headerlink" href="#deprecated-interfaces-language-features-attributes-and-conventions" title="Link to this heading">¶</a></h1>
<p>In a perfect world, it would be possible to convert all instances of
some deprecated API into the new API and entirely remove the old API in
a single development cycle. However, due to the size of the kernel, the
maintainership hierarchy, and timing, it’s not always feasible to do these
kinds of conversions at once. This means that new instances may sneak into
the kernel while old ones are being removed, only making the amount of
work to remove the API grow. In order to educate developers about what
has been deprecated and why, this list has been created as a place to
point when uses of deprecated things are proposed for inclusion in the
kernel.</p>
<section id="id1">
<h2>__deprecated<a class="headerlink" href="#id1" title="Link to this heading">¶</a></h2>
<p>While this attribute does visually mark an interface as deprecated,
it <a class="reference external" href="https://git.kernel.org/linus/771c035372a036f83353eef46dbb829780330234">does not produce warnings during builds any more</a>
because one of the standing goals of the kernel is to build without
warnings and no one was actually doing anything to remove these deprecated
interfaces. While using <cite>__deprecated</cite> is nice to note an old API in
a header file, it isn’t the full solution. Such interfaces must either
be fully removed from the kernel, or added to this file to discourage
others from using them in the future.</p>
</section>
<section id="bug-and-bug-on">
<h2>BUG() and BUG_ON()<a class="headerlink" href="#bug-and-bug-on" title="Link to this heading">¶</a></h2>
<p>Use <code class="xref c c-func broken_xref docutils literal notranslate"><span class="pre">WARN()</span></code> and <code class="xref c c-func broken_xref docutils literal notranslate"><span class="pre">WARN_ON()</span></code> instead, and handle the “impossible”
error condition as gracefully as possible. While the <code class="xref c c-func broken_xref docutils literal notranslate"><span class="pre">BUG()</span></code>-family
of APIs were originally designed to act as an “impossible situation”
assert and to kill a kernel thread “safely”, they turn out to just be
too risky. (e.g. “In what order do locks need to be released? Have
various states been restored?”) Very commonly, using <code class="xref c c-func broken_xref docutils literal notranslate"><span class="pre">BUG()</span></code> will
destabilize a system or entirely break it, which makes it impossible
to debug or even get viable crash reports. Linus has <a class="reference external" href="https://lore.kernel.org/lkml/CA+55aFy6jNLsywVYdGp83AMrXBo_P-pkjkphPGrO=82SPKCpLQ@mail.gmail.com/">very strong</a>
feelings <a class="reference external" href="https://lore.kernel.org/lkml/CAHk-=whDHsbK3HTOpTF=ue_o04onRwTEaK_ZoJp_fjbqq4+=Jw@mail.gmail.com/">about this</a>.</p>
<p>Note that the <code class="xref c c-func broken_xref docutils literal notranslate"><span class="pre">WARN()</span></code>-family should only be used for “expected to
be unreachable” situations. If you want to warn about “reachable
but undesirable” situations, please use the <a class="reference internal" href="../core-api/printk-basics.html#c.pr_warn" title="pr_warn"><code class="xref c c-func docutils literal notranslate"><span class="pre">pr_warn()</span></code></a>-family of
functions. System owners may have set the <em>panic_on_warn</em> sysctl,
to make sure their systems do not continue running in the face of
“unreachable” conditions. (For example, see commits like <a class="reference external" href="https://git.kernel.org/linus/d4689846881d160a4d12a514e991a740bcb5d65a">this one</a>.)</p>
</section>
<section id="open-coded-arithmetic-in-allocator-arguments">
<h2>open-coded arithmetic in allocator arguments<a class="headerlink" href="#open-coded-arithmetic-in-allocator-arguments" title="Link to this heading">¶</a></h2>
<p>Dynamic size calculations (especially multiplication) should not be
performed in memory allocator (or similar) function arguments due to the
risk of them overflowing. This could lead to values wrapping around and a
smaller allocation being made than the caller was expecting. Using those
allocations could lead to linear overflows of heap memory and other
misbehaviors. (One exception to this is literal values where the compiler
can warn if they might overflow. However, the preferred way in these
cases is to refactor the code as suggested below to avoid the open-coded
arithmetic.)</p>
<p>For example, do not use <code class="docutils literal notranslate"><span class="pre">count</span> <span class="pre">*</span> <span class="pre">size</span></code> as an argument, as in:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>foo = kmalloc(count * size, GFP_KERNEL);
</pre></div>
</div>
<p>Instead, the 2-factor form of the allocator should be used:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>foo = kmalloc_array(count, size, GFP_KERNEL);
</pre></div>
</div>
<p>Specifically, <a class="reference internal" href="../core-api/mm-api.html#c.kmalloc" title="kmalloc"><code class="xref c c-func docutils literal notranslate"><span class="pre">kmalloc()</span></code></a> can be replaced with <a class="reference internal" href="../core-api/mm-api.html#c.kmalloc_array" title="kmalloc_array"><code class="xref c c-func docutils literal notranslate"><span class="pre">kmalloc_array()</span></code></a>, and
<a class="reference internal" href="../core-api/mm-api.html#c.kzalloc" title="kzalloc"><code class="xref c c-func docutils literal notranslate"><span class="pre">kzalloc()</span></code></a> can be replaced with <a class="reference internal" href="../core-api/mm-api.html#c.kcalloc" title="kcalloc"><code class="xref c c-func docutils literal notranslate"><span class="pre">kcalloc()</span></code></a>.</p>
<p>If no 2-factor form is available, the saturate-on-overflow helpers should
be used:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>bar = dma_alloc_coherent(dev, array_size(count, size), &dma, GFP_KERNEL);
</pre></div>
</div>
<p>Another common case to avoid is calculating the size of a structure with
a trailing array of others structures, as in:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>header = kzalloc(sizeof(*header) + count * sizeof(*header->item),
GFP_KERNEL);
</pre></div>
</div>
<p>Instead, use the helper:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>header = kzalloc(struct_size(header, item, count), GFP_KERNEL);
</pre></div>
</div>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>If you are using <a class="reference internal" href="../core-api/kernel-api.html#c.struct_size" title="struct_size"><code class="xref c c-func docutils literal notranslate"><span class="pre">struct_size()</span></code></a> on a structure containing a zero-length
or a one-element array as a trailing array member, please refactor such
array usage and switch to a <a class="reference external" href="#zero-length-and-one-element-arrays">flexible array member</a> instead.</p>
</div>
<p>For other calculations, please compose the use of the <a class="reference internal" href="../core-api/kernel-api.html#c.size_mul" title="size_mul"><code class="xref c c-func docutils literal notranslate"><span class="pre">size_mul()</span></code></a>,
<a class="reference internal" href="../core-api/kernel-api.html#c.size_add" title="size_add"><code class="xref c c-func docutils literal notranslate"><span class="pre">size_add()</span></code></a>, and <a class="reference internal" href="../core-api/kernel-api.html#c.size_sub" title="size_sub"><code class="xref c c-func docutils literal notranslate"><span class="pre">size_sub()</span></code></a> helpers. For example, in the case of:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>foo = krealloc(current_size + chunk_size * (count - 3), GFP_KERNEL);
</pre></div>
</div>
<p>Instead, use the helpers:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>foo = krealloc(size_add(current_size,
size_mul(chunk_size,
size_sub(count, 3))), GFP_KERNEL);
</pre></div>
</div>
<p>For more details, also see <a class="reference internal" href="../core-api/kernel-api.html#c.array3_size" title="array3_size"><code class="xref c c-func docutils literal notranslate"><span class="pre">array3_size()</span></code></a> and <a class="reference internal" href="../core-api/kernel-api.html#c.flex_array_size" title="flex_array_size"><code class="xref c c-func docutils literal notranslate"><span class="pre">flex_array_size()</span></code></a>,
as well as the related <a class="reference internal" href="../core-api/kernel-api.html#c.check_mul_overflow" title="check_mul_overflow"><code class="xref c c-func docutils literal notranslate"><span class="pre">check_mul_overflow()</span></code></a>, <a class="reference internal" href="../core-api/kernel-api.html#c.check_add_overflow" title="check_add_overflow"><code class="xref c c-func docutils literal notranslate"><span class="pre">check_add_overflow()</span></code></a>,
<a class="reference internal" href="../core-api/kernel-api.html#c.check_sub_overflow" title="check_sub_overflow"><code class="xref c c-func docutils literal notranslate"><span class="pre">check_sub_overflow()</span></code></a>, and <a class="reference internal" href="../core-api/kernel-api.html#c.check_shl_overflow" title="check_shl_overflow"><code class="xref c c-func docutils literal notranslate"><span class="pre">check_shl_overflow()</span></code></a> family of functions.</p>
</section>
<section id="simple-strtol-simple-strtoll-simple-strtoul-simple-strtoull">
<h2>simple_strtol(), simple_strtoll(), simple_strtoul(), simple_strtoull()<a class="headerlink" href="#simple-strtol-simple-strtoll-simple-strtoul-simple-strtoull" title="Link to this heading">¶</a></h2>
<p>The <a class="reference internal" href="../core-api/kernel-api.html#c.simple_strtol" title="simple_strtol"><code class="xref c c-func docutils literal notranslate"><span class="pre">simple_strtol()</span></code></a>, <a class="reference internal" href="../core-api/kernel-api.html#c.simple_strtoll" title="simple_strtoll"><code class="xref c c-func docutils literal notranslate"><span class="pre">simple_strtoll()</span></code></a>,
<a class="reference internal" href="../core-api/kernel-api.html#c.simple_strtoul" title="simple_strtoul"><code class="xref c c-func docutils literal notranslate"><span class="pre">simple_strtoul()</span></code></a>, and <a class="reference internal" href="../core-api/kernel-api.html#c.simple_strtoull" title="simple_strtoull"><code class="xref c c-func docutils literal notranslate"><span class="pre">simple_strtoull()</span></code></a> functions
explicitly ignore overflows, which may lead to unexpected results
in callers. The respective <a class="reference internal" href="../core-api/kernel-api.html#c.kstrtol" title="kstrtol"><code class="xref c c-func docutils literal notranslate"><span class="pre">kstrtol()</span></code></a>, <a class="reference internal" href="../core-api/kernel-api.html#c.kstrtoll" title="kstrtoll"><code class="xref c c-func docutils literal notranslate"><span class="pre">kstrtoll()</span></code></a>,
<a class="reference internal" href="../core-api/kernel-api.html#c.kstrtoul" title="kstrtoul"><code class="xref c c-func docutils literal notranslate"><span class="pre">kstrtoul()</span></code></a>, and <a class="reference internal" href="../core-api/kernel-api.html#c.kstrtoull" title="kstrtoull"><code class="xref c c-func docutils literal notranslate"><span class="pre">kstrtoull()</span></code></a> functions tend to be the
correct replacements, though note that those require the string to be
NUL or newline terminated.</p>
</section>
<section id="strcpy">
<h2>strcpy()<a class="headerlink" href="#strcpy" title="Link to this heading">¶</a></h2>
<p><a class="reference internal" href="../core-api/kernel-api.html#c.strcpy" title="strcpy"><code class="xref c c-func docutils literal notranslate"><span class="pre">strcpy()</span></code></a> performs no bounds checking on the destination buffer. This
could result in linear overflows beyond the end of the buffer, leading to
all kinds of misbehaviors. While <cite>CONFIG_FORTIFY_SOURCE=y</cite> and various
compiler flags help reduce the risk of using this function, there is
no good reason to add new uses of this function. The safe replacement
is <a class="reference internal" href="../core-api/kernel-api.html#c.strscpy" title="strscpy"><code class="xref c c-func docutils literal notranslate"><span class="pre">strscpy()</span></code></a>, though care must be given to any cases where the return
value of <a class="reference internal" href="../core-api/kernel-api.html#c.strcpy" title="strcpy"><code class="xref c c-func docutils literal notranslate"><span class="pre">strcpy()</span></code></a> was used, since <a class="reference internal" href="../core-api/kernel-api.html#c.strscpy" title="strscpy"><code class="xref c c-func docutils literal notranslate"><span class="pre">strscpy()</span></code></a> does not return a pointer to
the destination, but rather a count of non-NUL bytes copied (or negative
errno when it truncates).</p>
</section>
<section id="strncpy-on-nul-terminated-strings">
<h2>strncpy() on NUL-terminated strings<a class="headerlink" href="#strncpy-on-nul-terminated-strings" title="Link to this heading">¶</a></h2>
<p>Use of <a class="reference internal" href="../core-api/kernel-api.html#c.strncpy" title="strncpy"><code class="xref c c-func docutils literal notranslate"><span class="pre">strncpy()</span></code></a> does not guarantee that the destination buffer will
be NUL terminated. This can lead to various linear read overflows and
other misbehavior due to the missing termination. It also NUL-pads
the destination buffer if the source contents are shorter than the
destination buffer size, which may be a needless performance penalty
for callers using only NUL-terminated strings.</p>
<p>When the destination is required to be NUL-terminated, the replacement is
<a class="reference internal" href="../core-api/kernel-api.html#c.strscpy" title="strscpy"><code class="xref c c-func docutils literal notranslate"><span class="pre">strscpy()</span></code></a>, though care must be given to any cases where the return value
of <a class="reference internal" href="../core-api/kernel-api.html#c.strncpy" title="strncpy"><code class="xref c c-func docutils literal notranslate"><span class="pre">strncpy()</span></code></a> was used, since <a class="reference internal" href="../core-api/kernel-api.html#c.strscpy" title="strscpy"><code class="xref c c-func docutils literal notranslate"><span class="pre">strscpy()</span></code></a> does not return a pointer to the
destination, but rather a count of non-NUL bytes copied (or negative
errno when it truncates). Any cases still needing NUL-padding should
instead use <a class="reference internal" href="../core-api/kernel-api.html#c.strscpy_pad" title="strscpy_pad"><code class="xref c c-func docutils literal notranslate"><span class="pre">strscpy_pad()</span></code></a>.</p>
<p>If a caller is using non-NUL-terminated strings, <a class="reference internal" href="../core-api/kernel-api.html#c.strtomem" title="strtomem"><code class="xref c c-func docutils literal notranslate"><span class="pre">strtomem()</span></code></a> should be
used, and the destinations should be marked with the <a class="reference external" href="https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html">__nonstring</a>
attribute to avoid future compiler warnings. For cases still needing
NUL-padding, <a class="reference internal" href="../core-api/kernel-api.html#c.strtomem_pad" title="strtomem_pad"><code class="xref c c-func docutils literal notranslate"><span class="pre">strtomem_pad()</span></code></a> can be used.</p>
</section>
<section id="strlcpy">
<h2>strlcpy()<a class="headerlink" href="#strlcpy" title="Link to this heading">¶</a></h2>
<p><code class="xref c c-func broken_xref docutils literal notranslate"><span class="pre">strlcpy()</span></code> reads the entire source buffer first (since the return value
is meant to match that of <a class="reference internal" href="../core-api/kernel-api.html#c.strlen" title="strlen"><code class="xref c c-func docutils literal notranslate"><span class="pre">strlen()</span></code></a>). This read may exceed the destination
size limit. This is both inefficient and can lead to linear read overflows
if a source string is not NUL-terminated. The safe replacement is <a class="reference internal" href="../core-api/kernel-api.html#c.strscpy" title="strscpy"><code class="xref c c-func docutils literal notranslate"><span class="pre">strscpy()</span></code></a>,
though care must be given to any cases where the return value of <code class="xref c c-func broken_xref docutils literal notranslate"><span class="pre">strlcpy()</span></code>
is used, since <a class="reference internal" href="../core-api/kernel-api.html#c.strscpy" title="strscpy"><code class="xref c c-func docutils literal notranslate"><span class="pre">strscpy()</span></code></a> will return negative errno values when it truncates.</p>
</section>
<section id="p-format-specifier">
<h2>%p format specifier<a class="headerlink" href="#p-format-specifier" title="Link to this heading">¶</a></h2>
<p>Traditionally, using “%p” in format strings would lead to regular address
exposure flaws in dmesg, proc, sysfs, etc. Instead of leaving these to
be exploitable, all “%p” uses in the kernel are being printed as a hashed
value, rendering them unusable for addressing. New uses of “%p” should not
be added to the kernel. For text addresses, using “%pS” is likely better,
as it produces the more useful symbol name instead. For nearly everything
else, just do not add “%p” at all.</p>
<p>Paraphrasing Linus’s current <a class="reference external" href="https://lore.kernel.org/lkml/CA+55aFwQEd_d40g4mUCSsVRZzrFPUJt74vc6PPpb675hYNXcKw@mail.gmail.com/">guidance</a>:</p>
<ul class="simple">
<li><p>If the hashed “%p” value is pointless, ask yourself whether the pointer
itself is important. Maybe it should be removed entirely?</p></li>
<li><p>If you really think the true pointer value is important, why is some
system state or user privilege level considered “special”? If you think
you can justify it (in comments and commit log) well enough to stand
up to Linus’s scrutiny, maybe you can use “%px”, along with making sure
you have sensible permissions.</p></li>
</ul>
<p>If you are debugging something where “%p” hashing is causing problems,
you can temporarily boot with the debug flag “<a class="reference external" href="https://git.kernel.org/linus/5ead723a20e0447bc7db33dc3070b420e5f80aa6">no_hash_pointers</a>”.</p>
</section>
<section id="variable-length-arrays-vlas">
<h2>Variable Length Arrays (VLAs)<a class="headerlink" href="#variable-length-arrays-vlas" title="Link to this heading">¶</a></h2>
<p>Using stack VLAs produces much worse machine code than statically
sized stack arrays. While these non-trivial <a class="reference external" href="https://git.kernel.org/linus/02361bc77888">performance issues</a> are reason enough to
eliminate VLAs, they are also a security risk. Dynamic growth of a stack
array may exceed the remaining memory in the stack segment. This could
lead to a crash, possible overwriting sensitive contents at the end of the
stack (when built without <cite>CONFIG_THREAD_INFO_IN_TASK=y</cite>), or overwriting
memory adjacent to the stack (when built without <cite>CONFIG_VMAP_STACK=y</cite>)</p>
</section>
<section id="implicit-switch-case-fall-through">
<h2>Implicit switch case fall-through<a class="headerlink" href="#implicit-switch-case-fall-through" title="Link to this heading">¶</a></h2>
<p>The C language allows switch cases to fall through to the next case
when a “break” statement is missing at the end of a case. This, however,
introduces ambiguity in the code, as it’s not always clear if the missing
break is intentional or a bug. For example, it’s not obvious just from
looking at the code if <cite>STATE_ONE</cite> is intentionally designed to fall
through into <cite>STATE_TWO</cite>:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>switch (value) {
case STATE_ONE:
do_something();
case STATE_TWO:
do_other();
break;
default:
WARN("unknown state");
}
</pre></div>
</div>
<p>As there have been a long list of flaws <a class="reference external" href="https://cwe.mitre.org/data/definitions/484.html">due to missing “break” statements</a>, we no longer allow
implicit fall-through. In order to identify intentional fall-through
cases, we have adopted a pseudo-keyword macro “fallthrough” which
expands to gcc’s extension <a class="reference external" href="https://gcc.gnu.org/onlinedocs/gcc/Statement-Attributes.html">__attribute__((__fallthrough__))</a>.
(When the C17/C18 <cite>[[fallthrough]]</cite> syntax is more commonly supported by
C compilers, static analyzers, and IDEs, we can switch to using that syntax
for the macro pseudo-keyword.)</p>
<p>All switch/case blocks must end in one of:</p>
<ul class="simple">
<li><p>break;</p></li>
<li><p>fallthrough;</p></li>
<li><p>continue;</p></li>
<li><p>goto <label>;</p></li>
<li><p>return [expression];</p></li>
</ul>
</section>
<section id="zero-length-and-one-element-arrays">
<h2>Zero-length and one-element arrays<a class="headerlink" href="#zero-length-and-one-element-arrays" title="Link to this heading">¶</a></h2>
<p>There is a regular need in the kernel to provide a way to declare having
a dynamically sized set of trailing elements in a structure. Kernel code
should always use <a class="reference external" href="https://en.wikipedia.org/wiki/Flexible_array_member">“flexible array members”</a>
for these cases. The older style of one-element or zero-length arrays should
no longer be used.</p>
<p>In older C code, dynamically sized trailing elements were done by specifying
a one-element array at the end of a structure:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>struct something {
size_t count;
struct foo items[1];
};
</pre></div>
</div>
<p>This led to fragile size calculations via sizeof() (which would need to
remove the size of the single trailing element to get a correct size of
the “header”). A <a class="reference external" href="https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html">GNU C extension</a>
was introduced to allow for zero-length arrays, to avoid these kinds of
size problems:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>struct something {
size_t count;
struct foo items[0];
};
</pre></div>
</div>
<p>But this led to other problems, and didn’t solve some problems shared by
both styles, like not being able to detect when such an array is accidentally
being used _not_ at the end of a structure (which could happen directly, or
when such a <code class="xref c c-struct broken_xref docutils literal notranslate"><span class="pre">struct</span> <span class="pre">was</span></code> in unions, structs of structs, etc).</p>
<p>C99 introduced “flexible array members”, which lacks a numeric size for
the array declaration entirely:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>struct something {
size_t count;
struct foo items[];
};
</pre></div>
</div>
<p>This is the way the kernel expects dynamically sized trailing elements
to be declared. It allows the compiler to generate errors when the
flexible array does not occur last in the structure, which helps to prevent
some kind of <a class="reference external" href="https://git.kernel.org/linus/76497732932f15e7323dc805e8ea8dc11bb587cf">undefined behavior</a>
bugs from being inadvertently introduced to the codebase. It also allows
the compiler to correctly analyze array sizes (via sizeof(),
<cite>CONFIG_FORTIFY_SOURCE</cite>, and <cite>CONFIG_UBSAN_BOUNDS</cite>). For instance,
there is no mechanism that warns us that the following application of the
sizeof() operator to a zero-length array always results in zero:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>struct something {
size_t count;
struct foo items[0];
};
struct something *instance;
instance = kmalloc(struct_size(instance, items, count), GFP_KERNEL);
instance->count = count;
size = sizeof(instance->items) * instance->count;
memcpy(instance->items, source, size);
</pre></div>
</div>
<p>At the last line of code above, <code class="docutils literal notranslate"><span class="pre">size</span></code> turns out to be <code class="docutils literal notranslate"><span class="pre">zero</span></code>, when one might
have thought it represents the total size in bytes of the dynamic memory recently
allocated for the trailing array <code class="docutils literal notranslate"><span class="pre">items</span></code>. Here are a couple examples of this
issue: <a class="reference external" href="https://git.kernel.org/linus/f2cd32a443da694ac4e28fbf4ac6f9d5cc63a539">link 1</a>,
<a class="reference external" href="https://git.kernel.org/linus/ab91c2a89f86be2898cee208d492816ec238b2cf">link 2</a>.
Instead, <a class="reference external" href="https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html">flexible array members have incomplete type, and so the sizeof()
operator may not be applied</a>,
so any misuse of such operators will be immediately noticed at build time.</p>
<p>With respect to one-element arrays, one has to be acutely aware that <a class="reference external" href="https://gcc.gnu.org/onlinedocs/gcc/Zero-Length.html">such arrays
occupy at least as much space as a single object of the type</a>,
hence they contribute to the size of the enclosing structure. This is prone
to error every time people want to calculate the total size of dynamic memory
to allocate for a structure containing an array of this kind as a member:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>struct something {
size_t count;
struct foo items[1];
};
struct something *instance;
instance = kmalloc(struct_size(instance, items, count - 1), GFP_KERNEL);
instance->count = count;
size = sizeof(instance->items) * instance->count;
memcpy(instance->items, source, size);
</pre></div>
</div>
<p>In the example above, we had to remember to calculate <code class="docutils literal notranslate"><span class="pre">count</span> <span class="pre">-</span> <span class="pre">1</span></code> when using
the <a class="reference internal" href="../core-api/kernel-api.html#c.struct_size" title="struct_size"><code class="xref c c-func docutils literal notranslate"><span class="pre">struct_size()</span></code></a> helper, otherwise we would have --unintentionally-- allocated
memory for one too many <code class="docutils literal notranslate"><span class="pre">items</span></code> objects. The cleanest and least error-prone way
to implement this is through the use of a <cite>flexible array member</cite>, together with
<a class="reference internal" href="../core-api/kernel-api.html#c.struct_size" title="struct_size"><code class="xref c c-func docutils literal notranslate"><span class="pre">struct_size()</span></code></a> and <a class="reference internal" href="../core-api/kernel-api.html#c.flex_array_size" title="flex_array_size"><code class="xref c c-func docutils literal notranslate"><span class="pre">flex_array_size()</span></code></a> helpers:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>struct something {
size_t count;
struct foo items[];
};
struct something *instance;
instance = kmalloc(struct_size(instance, items, count), GFP_KERNEL);
instance->count = count;
memcpy(instance->items, source, flex_array_size(instance, items, instance->count));
</pre></div>
</div>
<p>There are two special cases of replacement where the <code class="xref c c-func broken_xref docutils literal notranslate"><span class="pre">DECLARE_FLEX_ARRAY()</span></code>
helper needs to be used. (Note that it is named <code class="xref c c-func broken_xref docutils literal notranslate"><span class="pre">__DECLARE_FLEX_ARRAY()</span></code> for
use in UAPI headers.) Those cases are when the flexible array is either
alone in a <code class="xref c c-struct broken_xref docutils literal notranslate"><span class="pre">struct</span> <span class="pre">or</span></code> is part of a union. These are disallowed by the C99
specification, but for no technical reason (as can be seen by both the
existing use of such arrays in those places and the work-around that
<code class="xref c c-func broken_xref docutils literal notranslate"><span class="pre">DECLARE_FLEX_ARRAY()</span></code> uses). For example, to convert this:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>struct something {
...
union {
struct type1 one[0];
struct type2 two[0];
};
};
</pre></div>
</div>
<p>The helper must be used:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>struct something {
...
union {
DECLARE_FLEX_ARRAY(struct type1, one);
DECLARE_FLEX_ARRAY(struct type2, two);
};
};
</pre></div>
</div>
</section>
<section id="open-coded-kmalloc-assignments-for-struct-objects">
<h2>Open-coded kmalloc assignments for struct objects<a class="headerlink" href="#open-coded-kmalloc-assignments-for-struct-objects" title="Link to this heading">¶</a></h2>
<p>Performing open-coded <a class="reference internal" href="../core-api/mm-api.html#c.kmalloc" title="kmalloc"><code class="xref c c-func docutils literal notranslate"><span class="pre">kmalloc()</span></code></a>-family allocation assignments prevents
the kernel (and compiler) from being able to examine the type of the
variable being assigned, which limits any related introspection that
may help with alignment, wrap-around, or additional hardening. The
<a class="reference internal" href="../core-api/mm-api.html#c.kmalloc_obj" title="kmalloc_obj"><code class="xref c c-func docutils literal notranslate"><span class="pre">kmalloc_obj()</span></code></a>-family of macros provide this introspection, which can be
used for the common code patterns for single, array, and flexible object
allocations. For example, these open coded assignments:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ptr = kmalloc(sizeof(*ptr), gfp);
ptr = kzalloc(sizeof(*ptr), gfp);
ptr = kmalloc_array(count, sizeof(*ptr), gfp);
ptr = kcalloc(count, sizeof(*ptr), gfp);
ptr = kmalloc(struct_size(ptr, flex_member, count), gfp);
ptr = kmalloc(sizeof(struct foo, gfp);
</pre></div>
</div>
<p>become, respectively:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>ptr = kmalloc_obj(*ptr, gfp);
ptr = kzalloc_obj(*ptr, gfp);
ptr = kmalloc_objs(*ptr, count, gfp);
ptr = kzalloc_objs(*ptr, count, gfp);
ptr = kmalloc_flex(*ptr, flex_member, count, gfp);
__auto_type ptr = kmalloc_obj(struct foo, gfp);
</pre></div>
</div>
<p>If <cite>ptr->flex_member</cite> is annotated with <code class="xref c c-func broken_xref docutils literal notranslate"><span class="pre">__counted_by()</span></code>, the allocation
will automatically fail if <cite>count</cite> is larger than the maximum
representable value that can be stored in the counter member associated
with <cite>flex_member</cite>.</p>
</section>
</section>
</div>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="footer">
©The kernel development community.
|
Powered by <a href="https://www.sphinx-doc.org/">Sphinx 8.1.3</a>
& <a href="https://alabaster.readthedocs.io">Alabaster 0.7.16</a>
|
<a href="../_sources/process/deprecated.rst.txt"
rel="nofollow">Page source</a>
</div>
</body>
</html>