Re: Adding file descriptor attribute(s) to gcc and glibc

[Szabolcs Nagy <szabolcs.nagy@arm.com>]

The 07/12/2022 18:25, David Malcolm via Libc-alpha wrote:
> On Tue, 2022-07-12 at 18:16 -0400, David Malcolm wrote:
> > On Tue, 2022-07-12 at 23:03 +0530, Mir Immad wrote:
> > GCC's attribute syntax here:
> >   https://gcc.gnu.org/onlinedocs/gcc/Attribute-Syntax.html
> > allows for a parenthesized list of parameters for the attribute, which
> > can be:
> >  (a) An identifier
> >  (b) An identifier followed by a comma and a non-empty comma-separated
> > list of expressions
> >  (c) A possibly empty comma-separated list of expressions
> > 
> > I'd hoped to have an argument number, with an optional extra param
> > describing the direction of the access, but syntax (b) puts the
> > identifier first, alas.
> > 
> > Here's one possible way of doing it with a single attribute, via syntax
> > (b):
> > e.g.
> >    __attribute__((fd_argument (access, 1))
> >    __attribute__((fd_argument (read, 1))
> >    __attribute__((fd_argument (write, 1))
> > 
> > meaning that argument 1 of the function is expected to be an open file-
> > descriptor, and that it must be possible to read from/write to that fd
> > for cases 2 and 3.
> > 
> > Here are some possible examples of how glibc might use this syntax:
> > 
> >     int dup (int oldfd)
> >       __attribute((fd_argument (access, 1)); 
> > 
> >     int ftruncate (int fd, off_t length)
> >       __attribute((fd_argument (access, 1)); 
> > 
> >     ssize_t pread(int fd, void *buf, size_t count, off_t offset)
> >       __attribute((fd_argument (read, 1));
> > 
> >     ssize_t pwrite(int fd, const void *buf, size_t count, 
> >                    off_t offset);
> >       __attribute((fd_argument (write, 1));
> > 
> > ...but as I said, I'm most interested in input from glibc developers on
> > this.

note that glibc headers have to be namespace clean so it
would be more like

  __attribute__((__fd_argument (__access, 1)))
  __attribute__((__fd_argument (__read, 1)))
  __attribute__((__fd_argument (__write, 1)))

so it would be even shorter to write

  __attribute__((__fd_argument_access (1)))
  __attribute__((__fd_argument_read (1)))
  __attribute__((__fd_argument_write (1)))

> 
> I just realized that the attribute could accept both the single integer
> argument number (syntax (c)) for the "don't care about access
> direction" case, or the ({read|write}, N) of syntax (b) above, giving
> e.g.:
> 
>     int dup (int oldfd)
>       __attribute((fd_argument (1)); 
> 
>     int ftruncate (int fd, off_t length)
>       __attribute((fd_argument (1)); 
> 
>     ssize_t pread(int fd, void *buf, size_t count, off_t offset)
>       __attribute((fd_argument (read, 1));
> 
>     ssize_t pwrite(int fd, const void *buf, size_t count, 
>                    off_t offset);
>       __attribute((fd_argument (write, 1));
> 
> for the above examples.
> 
> How does that look?
> Dave

i think fd in ftruncate should be open for writing.

to be honest, i'd expect interesting fd bugs to be
dynamic and not easy to statically analyze.
the use-after-unchecked-open maybe useful. i would
not expect the access direction to catch many bugs.