Re: [PATCH v2 1/9] Compiler Attributes: Add __must_init macro

[Kees Cook <kees@xxxxxxxxxx>]

On Tue, Oct 27, 2026 at 03:38:36PM -0700, Ian Rogers wrote:
> Clang supports the 'require_explicit_initialization' attribute on struct
> fields to indicate that a field must be initialized explicitly by the
> user when the object is constructed. When an aggregate initializer or
> uninitialized variable omits an annotated field, Clang emits a
> -Wuninitialized-explicit-init warning (enabled by default).
> 
> Add the __must_init macro to include/linux/compiler_attributes.h (which
> is included by include/linux/compiler_types.h and
> include/linux/compiler.h) so kernel structs with error-prone
> initialization (such as mandatory callbacks or cleanup handlers) can
> enforce explicit initialization at compile time, as discussed at the
> Linux Plumbers Conference. The shorter __must_init spelling, rather than
> the attribute's full name, keeps annotated struct members readable and
> was suggested by Greg Kroah-Hartman.
> 
> Note that Clang does not yet diagnose file-scope objects declared
> without any initializer (initializers at file scope that omit the field
> are diagnosed), see https://github.com/llvm/llvm-project/issues/232483.
> 
> Also teach Sphinx (Documentation/conf.py), kernel-doc
> (tools/lib/python/kdoc/xforms_lists.py), and checkpatch.pl about the new
> attribute macro.
> 
> Link: https://lpc.events/event/20/contributions/2392/
> Link: https://lore.kernel.org/lkml/2026101532-fantastic-deafness-e04c@gregkh/
> Acked-by: Miguel Ojeda <ojeda@xxxxxxxxxx>
> Reviewed-by: Nick Desaulniers <ndesaulniers@xxxxxxxxxx>
> Reviewed-by: Nathan Chancellor <nathan@xxxxxxxxxx>
> Acked-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> Signed-off-by: Ian Rogers <irogers@xxxxxxxxxx>

Reviewed-by: Kees Cook <kees@xxxxxxxxxx>

As part of this, can you open a Clang bug for the lack of detecting
global initializers? It'd be nice to get that fixed.

-- 
Kees Cook