[PATCH] bug: remove __must_check requirement for CHECK_DATA_CORRUPTION()

[PATCH] bug: remove __must_check requirement for CHECK_DATA_CORRUPTION()

[Jann Horn]

There are codepaths that currently use something like WARN() where
CHECK_DATA_CORRUPTION() would be more appropriate, but it is not possible
to gracefully bail out when corruption has been detected.

CHECK_DATA_CORRUPTION() is currently deliberately unusable in such cases.
While it would be nice for users of CHECK_DATA_CORRUPTION() to bail out on
corruption, that shouldn't be a hard requirement for
CHECK_DATA_CORRUPTION().

So remove the __must_check requirement so that CHECK_DATA_CORRUPTION() can
be used in codepaths where bailing out is infeasible.

Signed-off-by: Jann Horn <jannh@google.com>
---
I think this should probably go through Kees' hardening tree?

This patch is inspired by me looking at file_ref_inc() and thinking
that that really should be using CHECK_DATA_CORRUPTION().
---
 include/linux/bug.h | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/include/linux/bug.h b/include/linux/bug.h
index 17a4933c611b..e8d1febd8ae4 100644
--- a/include/linux/bug.h
+++ b/include/linux/bug.h
@@ -89,22 +89,21 @@ static inline void mem_dump_obj(void *object) {}
 
 /*
  * Since detected data corruption should stop operation on the affected
- * structures. Return value must be checked and sanely acted on by caller.
+ * structures. Return value should be checked and sanely acted on by caller if
+ * possible.
  */
-static inline __must_check bool check_data_corruption(bool v) { return v; }
-#define CHECK_DATA_CORRUPTION(condition, addr, fmt, ...)		 \
-	check_data_corruption(({					 \
-		bool corruption = unlikely(condition);			 \
-		if (corruption) {					 \
-			if (addr)					 \
-				mem_dump_obj(addr);			 \
-			if (IS_ENABLED(CONFIG_BUG_ON_DATA_CORRUPTION)) { \
-				pr_err(fmt, ##__VA_ARGS__);		 \
-				BUG();					 \
-			} else						 \
-				WARN(1, fmt, ##__VA_ARGS__);		 \
-		}							 \
-		corruption;						 \
-	}))
+#define CHECK_DATA_CORRUPTION(condition, addr, fmt, ...) ({	 \
+	bool corruption = unlikely(condition);			 \
+	if (corruption) {					 \
+		if (addr)					 \
+			mem_dump_obj(addr);			 \
+		if (IS_ENABLED(CONFIG_BUG_ON_DATA_CORRUPTION)) { \
+			pr_err(fmt, ##__VA_ARGS__);		 \
+			BUG();					 \
+		} else						 \
+			WARN(1, fmt, ##__VA_ARGS__);		 \
+	}							 \
+	corruption;						 \
+})
 
 #endif	/* _LINUX_BUG_H */

---
base-commit: 3d6d817622b0a9721e3cc404df3469171582be13
change-id: 20260812-data-corruption-mustcheck-c1a8f76d6e24

Best regards,
--  
Jann Horn <jannh@google.com>