Re: free(3) const void *

[Alejandro Colomar <alx@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 2741 bytes --]

Hi Russ,

On Fri, Jan 26, 2024 at 10:09:35AM -0800, Russ Allbery wrote:
> Maybe this way of explaining the objection will help.  Right now, if you
> pass a const pointer into a function, you have some assurance from that
> prototype (assisted by compiler diagnostics) that this function will not
> modify *or invalidate* that pointer and you can continue using that
> pointer after that call.  In other words, while C does not have full
> Rust-style lifetime tracking, the const marker on a function approximately
> indicates that the caller is not passing ownership of the pointer to that
> function and the function call will not affect the pointer.
> 
> With this prototype, I believe you will create a situation where someone
> could write a function that takes a const pointer and then calls free() at
> the end of that function call on this passed parameter, and there would be
> no warning from the compiler either when compiling that function or when
> compiling a function that calls it and then uses the pointer afterwards
> (at least unless there is enough inlining that a compiler can put all the
> pieces together).

Unless I'm missing something, you wouldn't get a warning either if you
use a pointer after free(3), if that free() is hidden in a function
call.

	extern void my_free(void *p);

	my_free(p);
	my_free(p);

`const` doesn't make a difference there, regarding diagnostics about
use-after-free.

> Unless I'm missing something, the more specific annotation indicating that
> free() is a deallocator doesn't help because it doesn't propagate up the
> call stack.  It will catch use after free within the same function, but it
> won't catch the case where someone passes a const pointer down a whole
> chain of functions that take const pointers, and then the function at the
> bottom of that call stack frees the pointer, unless someone carefully
> annotates every function in that call stack with that annotation.  When
> this is done in error, someone obviously wouldn't do that.

You must propagate the annotation yourself (I don't remember from the
top of my head if there's any way to remind you if you firgot to
propagate it.

	[[gnu::access(none)]] extern void my_free_const(const void *p);
	[[gnu::malloc(my_free_const)]] extern void *my_malloc(size_t bytes);

	p = my_malloc(1);
	my_free_const(p);
	my_free_const(p);  // Warning: use-after-free

So, after Xi's reminder, I'll reformulate my suggestion to

	[[gnu::access(none)]]
	void free(const void *p);

(or for compatibility reasons, do the const thing via a macro.)

Have a lovely night,
Alex

-- 
<https://www.alejandro-colomar.es/>
Looking for a remote C programming job at the moment.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]