On Thu, Oct 15, 2026 at 1:07 PM Kees Cook <[email protected]> wrote: > > On Thu, Oct 15, 2026 at 09:47:34AM +0200, Miguel Ojeda wrote: > > On Thu, Oct 15, 2026 at 9:11 AM Greg KH <[email protected]> wrote: > > > > > > __must_init might be smaller? > > > > That sounds fine too. I like that it says that something *has* to be > > done (like the original name did). Hmm... On the other hand, I guess > > "must" could sound like one has to initialize the field "somehow", > > i.e. writing: > > > > struct S s = {}; > > > > definitely initializes it, yet the compiler would warn. Would > > "explicit" hint a bit more at the fact that one has to actually > > "write" the field, even if it may have been initialized anyway? > > > > (Of course, if one knows that the attribute only applies to fields, > > then it doesn't make much of a difference) > > Hmm, I just noticed Clang isn't diagnosing for file-scoped definitions. > I've opened: https://github.com/llvm/llvm-project/issues/232483 > > Do we want to wait on this attribute until Clang has full coverage for > all initializer cases, or land the attribute so we can continue to add > coverage for function-level coverage? I'm worried about a compiler bump > (once the bug is fixed) suddenly exposing a bunch of missed > initializers, but then again we also have no users yet...
This is a false negative, right? When it gets fixed in clang, the existing uses in globals start getting checked. Nothing that would require compiler version checks, IMO. > > -Kees > > -- > Kees Cook -- Thanks, ~Nick Desaulniers
