Re: [PATCH v4 4/6] stddef: Add const_cast()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [High] stddef: broken _Generic type associations in const_cast()
- [High] stddef: missing Signed-off-by trailer for Co-developed-by
  author
--

commit 773dbe524c50943cb4a47fa3a2b5e7f50b113c9d
Author: Alejandro Colomar <alx@kernel.org>

> stddef: Add const_cast()
>
> This macro serves to cast const away without risking unwanted
> conversions due to mistakes in the cast.
>
> It's similar to C++'s const_cast(), but it is more restrictive: it can
> only cast away 'const', and not arbitrary qualifiers.
>
> David made it a bit more robust.
>
> Link: https://lore.kernel.org/linux-hardening/20261111102535.434c2eee@pumpkin/
> Co-developed-by: David Laight <david.laight.linux@gmail.com>
> Signed-off-by: Alejandro Colomar <alx@kernel.org>

[Severity: High]
Co-developed-by: David Laight <david.laight.linux@gmail.com> is missing a
matching Signed-off-by trailer, which is required by the Developer's
Certificate of Origin rules (or Suggested-by can be used if he only
suggested an improvement on the list).

> diff --git a/include/linux/stddef.h b/include/linux/stddef.h
> index e1851c50c89b5..5201d71db3876 100644
> --- a/include/linux/stddef.h
> +++ b/include/linux/stddef.h
> @@ -194,4 +194,16 @@ enum {
>  #define TRAILING_OVERLAP(TYPE, NAME, FAM, MEMBERS)				\
>  	__TRAILING_OVERLAP(TYPE, NAME, FAM, /* no attrs */, MEMBERS)
>  
> +/**
> + * const_cast() - At most, drop const in the left-most derivation of a pointer
> + *
> + * @T: Type for the cast.
> + * @p: Pointer to be casted.
> + *
> + * If @p is of type const @T, then it is casted to @T.
> + * If @p is of type @T, then it is returned without any casts.
> + * This avoids mistakes that change anything other than 'const' in a cast.
> + */
> +#define const_cast(T, p)  _Generic(p, const T: (T) (p), T: (p))

[Severity: High]
Does const_cast(T, p) fail to compile when T is already a pointer to a
const-qualified type?  When T is const char *, textually prepending const
produces const const char *, which collapses to const char * and gives
_Generic two associations with the same type; this breaks the build in
drivers/base/property.c (fwnode_name_eq()) once strprefix() uses
const_cast() on a const char * argument.

When T is a pointer typedef or typeof(ptr), const T qualifies the pointer
itself (char * const) rather than the pointee, and since _Generic strips
top-level qualifiers from p, the const T association never matches a
pointer to const.  For a multi-level pointer such as char **, const T
expands to const char ** instead of char * const *, rejecting valid
char * const * inputs while permitting unsafe const char ** to char **
casts.  Also, omitting the (T) cast in the T: (p) branch leaves a
non-const array argument with its array type and sizeof instead of
returning a pointer of type T.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1794425425.git.alx@kernel.org?part=4