On Thu, Jun 8, 2023 at 9:47 AM Kees Cook <keescook@xxxxxxxxxxxx> wrote:
>
> On Thu, Jun 08, 2023 at 08:45:53AM -0700, Linus Torvalds wrote:
> > So for convenient automatic pointer freeing, you want an interface
> > much more akin to
> >
> > struct whatever *ptr __automatic_kfree = kmalloc(...);
> >
> > which is much more legible, doesn't have any type mis-use issues, and
> > is also just trivially dealt with by a
> >
> > static inline void automatic_kfree_wrapper(void *pp)
> > { void *p = *(void **)pp; if (p) kfree(p); }
> > #define __automatic_kfree \
> > __attribute__((__cleanup__(automatic_kfree_wrapper)))
> > #define no_free_ptr(p) \
> > ({ __auto_type __ptr = (p); (p) = NULL; __ptr; })
> >
> > which I just tested generates the sane code even for the "set the ptr
> > to NULL and return success" case.
> >
> > The above allows you to trivially do things like
> >
> > struct whatever *p __automatic_kfree = kmalloc(..);
> >
> > if (!do_something(p))
> > return -ENOENT;
> >
> > return no_free_ptr(p);
>
> I am a little worried about how (any version so far of) this API could go
> wrong, e.g. if someone uses this and does "return p" instead of "return
> no_free_ptr(p)", it'll return a freed pointer.
Presumably, one could simply just not use RAII(/SBRM someone else
corrected me about this recently coincidentally; I taught them my fun
C++ acronym IDGAF) when working with a value that conditionally
"escapes" the local scope.
--
Thanks,
~Nick Desaulniers
