Linus Torvalds [off-list ref] writes:
So let's make a new rule:
We absolutely NEVER add things like "must_check" unless not checking
causes a real and obvious SECURITY ISSUE.
Oh, come on, almost every kernel bug is a potential security issue.
IMHO, if the function can only fail due to a kernel bug, it should
return void and, in case of bug, explode with BUG_ON() or something
like that. Sure, must_check doesn't apply too well to void.
But, if I have functions which can fail for legitimate (not kernel
bug) reasons, and I know ignoring their return values would always
be a bug, then must_check seems an obvious best and simple defense
against that.
--
Krzysztof Halasa
On Thu, 19 Jul 2007, Krzysztof Halasa wrote:
quoted
We absolutely NEVER add things like "must_check" unless not checking
causes a real and obvious SECURITY ISSUE.
Oh, come on, almost every kernel bug is a potential security issue.
Sure. And adding unnecessary checking that doesn't make sense makes bugs
*more* likely rather than less.
IMHO, if the function can only fail due to a kernel bug, it should
return void and, in case of bug, explode with BUG_ON() or something
like that. Sure, must_check doesn't apply too well to void.
There are absolutely tons of functions that can return errors (or other
values), and where many users MAY SIMPLY NOT CARE.
I think "must_check" is an abomination. It makes the callee dictate what
the caller has to do, but dammit, if the callee really "knows" its errors
are that serious, it should damn well handle them itself.
The whole "sysfs_create_file()" thing is an example of that. If it fails,
it fails. The caller can't do anythign about it anyway, except perhaps
print a message. Why the hell does such a function have the "right" to
dictate what the user should do?
That doesn't mean that *all* callers migth not care. Maybe some internal
sysfs routines really should care. But not a random driver.
Linus
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
Linus Torvalds wrote:
I think "must_check" is an abomination. It makes the callee dictate what
the caller has to do, but dammit, if the callee really "knows" its errors
are that serious, it should damn well handle them itself.
The whole "sysfs_create_file()" thing is an example of that. If it fails,
it fails. The caller can't do anythign about it anyway, except perhaps
print a message. Why the hell does such a function have the "right" to
dictate what the user should do?
Well, that's just how OO fascists think. An object dictates to the user
what he/she can do with it, as opposed to the user can do what he
wants/needs.
Tim