From nobody Wed Apr 1 10:27:03 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5652426686; Tue, 31 Mar 2026 16:37:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774975046; cv=none; b=PnbO255MRcW+aRP4ryirODdgsKypg/t2BycE/ZK6yRzO9tBcwQ0e3CqejguL//uEyT1nWX0jX3nwLwYXakZnRkObzYtR/qUfV0jFkLjIGeaO560HPDayFiuj4f5f916UtogMXt5tmEbZvbO4+xM3sSLWsoMiQywkZSy3KCSxTjM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774975046; c=relaxed/simple; bh=a4JG7usT6Z6N0Znenn9HJ2Ff5uUsHYvIsmUVVM1ha74=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version:Content-Type; b=q3uNRHeQL6hciqVKt9AJQIHfRZgZ21+yHWFzpqTkcftt7qWRahBHkNTkvSmhz5eq6/QTDfTpSCG7A6A4yiRk2xwLeL5L9zK2JHKR5wbUgy2k4UOYqFhKBKWGkVyCu7DZm7XZMNXxvMq+PPGJowk4xn7o5tWYOywPpijfv84g9Eg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=uqAi4pN1; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="uqAi4pN1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 721D1C4AF10; Tue, 31 Mar 2026 16:37:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774975046; bh=a4JG7usT6Z6N0Znenn9HJ2Ff5uUsHYvIsmUVVM1ha74=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uqAi4pN1Z8ucCsiUu+1eUEmYdhAcjaNzGIJbAW+vfqMgV8q3KsXOGzY9mWLYYBh4X ZQmhGSdJI0TaVO58Lqu8FphqRR/iCQuxsIEoFxRTMV10UPeK1QpZHaoQc6t4W1XQkq BFU35lt9z23/4W+IlSN/mxlZGuzkQtOetnlmjbx7J4KDGU1y1i09LU3wc+GH515fgH Ln57eaoQYAeAdygThC3LXzzmc3niIpq/H6kXByGfjh4w6u/KVwFJYl4klVEYZPDgNk SK8qHE5w7mFovWtXo0waaUNjsVuo8A08pE+SHHf1H908opsLv2laztVDYGj754m/W8 SQZuSHzyfBFTA== From: Kees Cook To: Peter Zijlstra Cc: Kees Cook , Justin Stitt , Linus Torvalds , Miguel Ojeda , Nathan Chancellor , Andrew Morton , Andy Shevchenko , Arnd Bergmann , Mark Rutland , "Matthew Wilcox (Oracle)" , Suren Baghdasaryan , Thomas Gleixner , Finn Thain , Geert Uytterhoeven , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , llvm@lists.linux.dev, Marco Elver , Jonathan Corbet , Nicolas Schier , Greg Kroah-Hartman , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-hardening@vger.kernel.org, linux-doc@vger.kernel.org, linux-kbuild@vger.kernel.org Subject: [PATCH 5/5] types: Add standard __ob_trap and __ob_wrap scalar types Date: Tue, 31 Mar 2026 09:37:23 -0700 Message-Id: <20260331163725.2765789-5-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260331163716.work.696-kees@kernel.org> References: <20260331163716.work.696-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-Developer-Signature: v=1; a=openpgp-sha256; l=3375; i=kees@kernel.org; h=from:subject; bh=a4JG7usT6Z6N0Znenn9HJ2Ff5uUsHYvIsmUVVM1ha74=; b=owGbwMvMwCVmps19z/KJym7G02pJDJmnfzgZ57sa8O8X3MkZ/Vz6c6bB4oNsS4PMX3XHaUXdd 3ZlaXrbUcrCIMbFICumyBJk5x7n4vG2Pdx9riLMHFYmkCEMXJwCMBG3aEaGzeJcdxR3hV4+v/KV nrJlaC3f6y/mnHum/TX2kJ0qnP/oCcMfnoIja5QXO+2M6nzmfkX759RuaybtVE0Zge6GW/u+tpi xAAA= X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable While Linux's use of -fno-strict-overflow means that all arithmetic operations have a defined behavior (2's-complement wrapping), there isn't a way to unambiguously specify if a given variable was designed or intended to wrap around by the author. Introduce explicit trapping and wrapping types for all bit widths including architecture word length (i.e. "long"), signed and unsigned, for use going forward for unambiguous arithmetic, now available via Clang 23+'s Overflow Behavior Types[1] (CONFIG_OVERFLOW_BEHAVIOR_TYPES=3Dy). Bike shedding time! How should these be named? We already have the short bit width types, named as: {u,s}{8,16,32,64}. We need to construct new type names that also indicate their overflow behavior: "trapping" or "wrapping". And we need to capture the "architectural word" length type too (i.e. what "unsigned long" or "size_t" captures). Whole word addition: - Pro: Unambiguous - Con: Long. E.g. suffixed "u16_trap", or prefixed "wrap_u16" Single letter addition, "t" for "trap" and "w" for "wrap": - At the end: but "u8t" looks like the "t" is "type", like "uint8_t". - At the front: but "wu8" looks like the "w" is "wide", like "wchar_t". Current straw-man proposal is single letter suffix because it vaguely felt like the least bad of all choices, and they should be short or everyone will just continue to type "int". :) Link: https://clang.llvm.org/docs/OverflowBehaviorTypes.html [1] Signed-off-by: Kees Cook --- Cc: Justin Stitt Cc: Peter Zijlstra Cc: Linus Torvalds Cc: Miguel Ojeda Cc: Nathan Chancellor Cc: Andrew Morton Cc: Andy Shevchenko Cc: Arnd Bergmann Cc: Mark Rutland Cc: "Matthew Wilcox (Oracle)" Cc: Suren Baghdasaryan Cc: Thomas Gleixner Cc: Finn Thain Cc: Geert Uytterhoeven Cc: "Thomas Wei=C3=9Fschuh" Cc: --- include/linux/types.h | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/include/linux/types.h b/include/linux/types.h index 7e71d260763c..786eb2c9775f 100644 --- a/include/linux/types.h +++ b/include/linux/types.h @@ -94,6 +94,30 @@ typedef unsigned int uint; typedef unsigned long ulong; typedef unsigned long long ullong; =20 +/* Trapping types. */ +typedef u8 __ob_trap u8t; +typedef u16 __ob_trap u16t; +typedef u32 __ob_trap u32t; +typedef u64 __ob_trap u64t; +typedef unsigned long __ob_trap ulongt; +typedef s8 __ob_trap s8t; +typedef s16 __ob_trap s16t; +typedef s32 __ob_trap s32t; +typedef s64 __ob_trap s64t; +typedef signed long __ob_trap slongt; + +/* Wrapping types. */ +typedef u8 __ob_wrap u8w; +typedef u16 __ob_wrap u16w; +typedef u32 __ob_wrap u32w; +typedef u64 __ob_wrap u64w; +typedef unsigned long __ob_wrap ulongw; +typedef s8 __ob_wrap s8w; +typedef s16 __ob_wrap s16w; +typedef s32 __ob_wrap s32w; +typedef s64 __ob_wrap s64w; +typedef signed long __ob_wrap slongw; + #ifndef __BIT_TYPES_DEFINED__ #define __BIT_TYPES_DEFINED__ =20 --=20 2.34.1