Re: free(3) const void *

[Russ Allbery <eagle@eyrie.org>]

Alejandro Colomar <alx@kernel.org> writes:

> Unless I'm missing something, you wouldn't get a warning either if you
> use a pointer after free(3), if that free() is hidden in a function
> call.

> 	extern void my_free(void *p);

> 	my_free(p);
> 	my_free(p);

> `const` doesn't make a difference there, regarding diagnostics about
> use-after-free.

Yes, const can't help you prevent problems where you don't use const.  :)

I'm not saying that using const catches every C programming bug.  But
using const currently does ensure that nothing in the call stack into
which you pass a const pointer frees that pointer, unless it uses an
explicit cast or otherwise breaks its interface contract.

(C in general, and by design, does not protect you from code that doesn't
follow its interface contract, instead erring on the side of providing
escape hatches to do odd things.  Nonetheless, interface contracts such as
const are still helpful in finding bugs within collaborating code, even if
they're not strictly enforced in every circumstance.)

> So, after Xi's reminder, I'll reformulate my suggestion to

> 	[[gnu::access(none)]]
> 	void free(const void *p);

> (or for compatibility reasons, do the const thing via a macro.)

Maybe I'm missing something, but I don't see how this addresses the
concerns that were raised.

-- 
Russ Allbery (eagle@eyrie.org)             <https://www.eyrie.org/~eagle/>