On Tue, Oct 27, 2026 at 03:38:36PM -0700, Ian Rogers wrote: > Clang supports the 'require_explicit_initialization' attribute on struct > fields to indicate that a field must be initialized explicitly by the > user when the object is constructed. When an aggregate initializer or > uninitialized variable omits an annotated field, Clang emits a > -Wuninitialized-explicit-init warning (enabled by default). > > Add the __must_init macro to include/linux/compiler_attributes.h (which > is included by include/linux/compiler_types.h and > include/linux/compiler.h) so kernel structs with error-prone > initialization (such as mandatory callbacks or cleanup handlers) can > enforce explicit initialization at compile time, as discussed at the > Linux Plumbers Conference. The shorter __must_init spelling, rather than > the attribute's full name, keeps annotated struct members readable and > was suggested by Greg Kroah-Hartman. > > Note that Clang does not yet diagnose file-scope objects declared > without any initializer (initializers at file scope that omit the field > are diagnosed), see https://github.com/llvm/llvm-project/issues/232483. > > Also teach Sphinx (Documentation/conf.py), kernel-doc > (tools/lib/python/kdoc/xforms_lists.py), and checkpatch.pl about the new > attribute macro. > > Link: https://lpc.events/event/20/contributions/2392/ > Link: https://lore.kernel.org/lkml/2026101532-fantastic-deafness-e04c@gregkh/ > Acked-by: Miguel Ojeda <[email protected]> > Reviewed-by: Nick Desaulniers <[email protected]> > Reviewed-by: Nathan Chancellor <[email protected]> > Acked-by: Greg Kroah-Hartman <[email protected]> > Signed-off-by: Ian Rogers <[email protected]>
Reviewed-by: Kees Cook <[email protected]> As part of this, can you open a Clang bug for the lack of detecting global initializers? It'd be nice to get that fixed. -- Kees Cook
