]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
slab.h: disable completely broken overflow handling in flex allocations
authorLinus Torvalds <torvalds@linux-foundation.org>
Sat, 21 Feb 2026 23:12:09 +0000 (15:12 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Sat, 21 Feb 2026 23:12:09 +0000 (15:12 -0800)
Commit 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for
non-scalar types") started using the new allocation helpers, and in the
process showed that they were completely non-working.

The overflow logic in overflows_flex_counter_type() is completely the
wrong way around, and that broke __alloc_flex() completely.  By chance,
the resulting code was then such a mess that clang generated
sufficiently garbage code that objtool warned about it all.  Which made
it somewhat quicker to narrow things down.

While fixing overflows_flex_counter_type() would presumably fix this
all, I'm excising the whole broken overflow logic from __alloc_flex(),
because we don't want that kind of code in basic allocation functions
anyway.

That (no longer) broken overflows_flex_counter_type() thing needs to be
inserted into the actual __set_flex_counter() logic in the unlikely case
that we ever want this at all.  And made conditional.

Fixes: 81cee9166a90 ("compiler_types: Introduce __flex_counter() and family")
Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types")
Cc: Kees Cook <kees@kernel.org>
Link: https://lore.kernel.org/all/CAHk-=whEd020BYzGTzYrENjD9Z5_82xx6h8HsQvH5xDSnv0=Hw@mail.gmail.com/
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
include/linux/overflow.h
include/linux/slab.h

index a5e95dbce2207e2e241748a948fe1ebb5ded41d0..eddd987a85132f9abe7591bfc8db3d56c08e6c87 100644 (file)
@@ -570,7 +570,7 @@ static inline size_t __must_check size_sub(size_t minuend, size_t subtrahend)
  * @FAM is not annotated with __counted_by(), always returns true.
  */
 #define overflows_flex_counter_type(TYPE, FAM, COUNT)          \
-       (!overflows_type(COUNT, typeof_flex_counter(((TYPE *)NULL)->FAM)))
+       (overflows_type(COUNT, typeof_flex_counter(((TYPE *)NULL)->FAM)))
 
 /**
  * __set_flex_counter() - Set the counter associated with the given flexible
index c5fde87402814e35c63c5305c59cf6d390d4c700..1270320b59c894edb40a4368563100e42fe13749 100644 (file)
@@ -1003,11 +1003,7 @@ void *kmalloc_nolock_noprof(size_t size, gfp_t gfp_flags, int node);
 ({                                                                     \
        const size_t __count = (COUNT);                                 \
        const size_t __obj_size = struct_size_t(TYPE, FAM, __count);    \
-       TYPE *__obj_ptr;                                                \
-       if (WARN_ON_ONCE(overflows_flex_counter_type(TYPE, FAM, __count))) \
-               __obj_ptr = NULL;                                       \
-       else                                                            \
-               __obj_ptr = KMALLOC(__obj_size, GFP);                   \
+       TYPE *__obj_ptr = KMALLOC(__obj_size, GFP);                     \
        if (__obj_ptr)                                                  \
                __set_flex_counter(__obj_ptr->FAM, __count);            \
        __obj_ptr;                                                      \