signed vs unsigned pointer warning

[Richard Henderson <rth@redhat.com>]

[ Forwarded from the thread beginning at
  http://marc.theaimsgroup.com/?l=linux-sparse&m=109577992701909&w=2
]

On Tue, Sep 21, 2004 at 09:49:43AM -0700, Linus Torvalds wrote:
> In fact, even the "explicit sign" differences are a bit questionable. The 
> xdr4 code does something like this:
> 
> 	s64	len, start, end;
> 	...
> 	p = xdr_decode_hyper(p, &start);
> 	p = xdr_decode_hyper(p, &len);
> 	..
> 
> and both of these generate warnings, because xdr_decode_hyper() looks like
> 
> 	static inline u32 *
> 	xdr_decode_hyper(u32 *p, __u64 *valp)
> 
> but the fact is, it obviously works fine to return both u64 and s64
> values, and forcing the caller to use one over the other is just not that
> sensible.

Maybe.  Or maybe it's a bug that the caller typo'd s64 instead of u64,
and (start < end) will mistakenly compare false when end gets large.

> ... and duplicating the function to do the same thing also seems 
> totally idiotic.

I don't agree.  If signed vs unsigned really isn't important, because
xdr_decode_hyper does no range checking, yadda yadda, then

	static inline u32 *
	xdr_decode_hyper_s(u32 *p, s64 *valp)
	{
	  return xdr_decode_hyper (p, (u64 *) valp));
	}

does not seem too much to ask.

> Richard, are you sure that the gcc team has thought this through wrt
> gcc-4.0, or is this just another total disaster like adding
> "-Wsign-compare" to the default flags in gcc-3.0?

I think we're on more solid ground here than -Wsign-compare, because
the types "int *" and "unsigned int *" are not compatible [c99 6.2.7].
IANAL, but we could be within our rights to reject the program entirely
[c99 6.5.16.1].

I am finding it somewhat annoying that there's no -W switch to turn it
off though, since there are three include/linux/ headers that now prevent
me from using -Werror under arch/alpha/.


r~