On Tue, Oct 21, 2025 at 12:24:05PM -0700, Kees Cook wrote:
On Tue, Oct 21, 2025 at 11:54:47AM +0200, Peter Zijlstra wrote:
So why do we need both __counted_by_ptr() and this __sized_by(), won't one be good enough?
I remain extraordinarily frustrated that counted_by can't be used with "void *". I hit a brick wall on this, though, and don't know how to convince either GCC or Clang devs to fix it. It's so obviously correct to me: "void *" uses a 1 byte iterator for arithmetic... so asking how big a given allocation is should be byte sized!
Right, at least for gnu11 language variants this really should work. I mean, disallow the usage for c11 if you're pedantic but for crying out loud, have the GNU extensions be consistent and all that.
Feel free to use my feedback if it would help.
Let me take another stab at it...
Thanks!
As for avoiding __counted_by_ptr(), we could just raise the minimum Clang and GCC versions to require this, but that means dropping existing coverage (e.g GCC 15 supports only flexible array counted_by).
Maybe we could do a global __counted_by_ptr -> __counted_by replacement once GCC 16 is released?
That sounds like a plan! :-)