On Mon, Oct 20, 2025 at 03:53:55PM -0700, Bill Wendling wrote:
On Mon, Oct 20, 2025 at 3:01 PM Kees Cook kees@kernel.org wrote:
Introduce __counted_by_ptr(), which works like __counted_by(), but for pointer struct members:
struct foo { int a, b, c; char *buffer __counted_by_ptr(bytes); short nr_bars; struct bar *bars __counted_by_ptr(nr_bars); size_t bytes; };
Since "counted_by" can only be applied to pointer members in very recent compiler versions, its application ends up needing to be distinct from flexible array "counted_by" annotations, hence a separate macro.
Unfortunately, this annotation cannot be used for "void *" members (since such a member is considered a pointer to an incomplete type, and neither Clang nor GCC developers could be convinced otherwise[1], even in the face of the GNU extension that "void *" has size "1 byte" for pointer arithmetic). For "void *" members, we must use the coming "sized_by" attribute.
I'm pretty sure that "sized_by" is available in Clang right now.
My clang-22 build seems to accept it no problem indeed -- although I've not verified it actually does anything with it.