[PATCH 0/2] devres: Provide kmalloc_obj*-style API for devm_kmalloc

[PATCH 0/2] devres: Provide kmalloc_obj*-style API for devm_kmalloc

[Kees Cook]

Hi,

As a continuation of the type-based allocator work, this introduces the
wrappers for devm_kmalloc()-family to use the _obj/_objs/_flex API that
the kmalloc()-family has moved to. Along with the coming changes to
scripts/coccinelle/api/kmalloc_objs.cocci to support devm_kmalloc()
conversions, this will result in the following uses:

            6644    devm_kzalloc_obj()
            1714    devm_kzalloc_objs()
             296    devm_kzalloc_flex()
              89    devm_kmalloc_objs()
              83    devm_kmalloc_obj()
               2    devm_kmalloc_flex()

which totals out in diffstat to:

 5908 files changed, 10013 insertions(+), 12082 deletions(-)

-Kees

Kees Cook (2):
  mm: Move default_gfp() into gfp_types.h
  devres: Provide kmalloc_obj*-style API for devm_kmalloc

 include/linux/device/devres.h | 102 ++++++++++++++++++++++++++++++++++
 include/linux/gfp.h           |   4 --
 include/linux/gfp_types.h     |   4 ++
 3 files changed, 106 insertions(+), 4 deletions(-)

-- 
2.34.1

[PATCH 1/2] mm: Move default_gfp() into gfp_types.h

[Kees Cook]

Using default_gfp() only depends on the GFP_KERNEL value. Move
default_gfp() into gfp_types.h so that future use in devres.h doesn't
require pulling in all of gfp.h.

Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: "Liam R. Howlett" <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Brendan Jackman <brendan.jackman@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: <linux-mm@kvack.org>
---
 include/linux/gfp.h       | 4 ----
 include/linux/gfp_types.h | 4 ++++
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 872bc53f32ec..b62e2fd53cb4 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -13,10 +13,6 @@
 struct vm_area_struct;
 struct mempolicy;
 
-/* Helper macro to avoid gfp flags if they are the default one */
-#define __default_gfp(a,b,...) b
-#define default_gfp(...) __default_gfp(,##__VA_ARGS__,GFP_KERNEL)
-
 static inline bool gfpflags_allow_blocking(const gfp_t gfp_flags)
 {
 	return !!(gfp_flags & __GFP_DIRECT_RECLAIM);
diff --git a/include/linux/gfp_types.h b/include/linux/gfp_types.h
index 190191411009..b1cd143f3c42 100644
--- a/include/linux/gfp_types.h
+++ b/include/linux/gfp_types.h
@@ -382,4 +382,8 @@ enum {
 			 __GFP_NOMEMALLOC | __GFP_NOWARN) & ~__GFP_RECLAIM)
 #define GFP_TRANSHUGE	(GFP_TRANSHUGE_LIGHT | __GFP_DIRECT_RECLAIM)
 
+/* Helper macro to avoid gfp flags if they are the default one */
+#define __default_gfp(a,b,...) b
+#define default_gfp(...) __default_gfp(,##__VA_ARGS__,GFP_KERNEL)
+
 #endif /* __LINUX_GFP_TYPES_H */
-- 
2.34.1

Re: [PATCH 1/2] mm: Move default_gfp() into gfp_types.h

[Zi Yan]

On Mon Sep 14, 2026 at 6:32 PM EDT, Kees Cook wrote:
> Using default_gfp() only depends on the GFP_KERNEL value. Move
> default_gfp() into gfp_types.h so that future use in devres.h doesn't
> require pulling in all of gfp.h.
>
> Signed-off-by: Kees Cook <kees@kernel.org>
> ---
> Cc: Lorenzo Stoakes <ljs@kernel.org>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Cc: David Hildenbrand <david@kernel.org>
> Cc: "Liam R. Howlett" <liam@infradead.org>
> Cc: Vlastimil Babka <vbabka@kernel.org>
> Cc: Mike Rapoport <rppt@kernel.org>
> Cc: Suren Baghdasaryan <surenb@google.com>
> Cc: Michal Hocko <mhocko@suse.com>
> Cc: Brendan Jackman <brendan.jackman@linux.dev>
> Cc: Johannes Weiner <hannes@cmpxchg.org>
> Cc: Zi Yan <ziy@nvidia.com>
> Cc: <linux-mm@kvack.org>
> ---
>  include/linux/gfp.h       | 4 ----
>  include/linux/gfp_types.h | 4 ++++
>  2 files changed, 4 insertions(+), 4 deletions(-)
>

Makes sense.

Reviewed-by: Zi Yan <ziy@nvidia.com>


-- 
Best Regards,
Yan, Zi

Re: [PATCH 1/2] mm: Move default_gfp() into gfp_types.h

[Vlastimil Babka (SUSE)]

On 9/15/26 00:32, Kees Cook wrote:
> Using default_gfp() only depends on the GFP_KERNEL value. Move
> default_gfp() into gfp_types.h so that future use in devres.h doesn't
> require pulling in all of gfp.h.
> 
> Signed-off-by: Kees Cook <kees@kernel.org>

Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>

Incidentally I was thinking if default_gfp(...) usage should be extended
also for the legacy kmalloc() API. Because it's going to still have users,
buffers are needed for many things that are not objects (structs). Mike is
converting many unnecessary page allocator usages to kmalloc(PAGE_SIZE, ...)
often with GFP_KERNEL, so that would be neater too...

> ---
> Cc: Lorenzo Stoakes <ljs@kernel.org>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Cc: David Hildenbrand <david@kernel.org>
> Cc: "Liam R. Howlett" <liam@infradead.org>
> Cc: Vlastimil Babka <vbabka@kernel.org>
> Cc: Mike Rapoport <rppt@kernel.org>
> Cc: Suren Baghdasaryan <surenb@google.com>
> Cc: Michal Hocko <mhocko@suse.com>
> Cc: Brendan Jackman <brendan.jackman@linux.dev>
> Cc: Johannes Weiner <hannes@cmpxchg.org>
> Cc: Zi Yan <ziy@nvidia.com>
> Cc: <linux-mm@kvack.org>
> ---
>  include/linux/gfp.h       | 4 ----
>  include/linux/gfp_types.h | 4 ++++
>  2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/include/linux/gfp.h b/include/linux/gfp.h
> index 872bc53f32ec..b62e2fd53cb4 100644
> --- a/include/linux/gfp.h
> +++ b/include/linux/gfp.h
> @@ -13,10 +13,6 @@
>  struct vm_area_struct;
>  struct mempolicy;
>  
> -/* Helper macro to avoid gfp flags if they are the default one */
> -#define __default_gfp(a,b,...) b
> -#define default_gfp(...) __default_gfp(,##__VA_ARGS__,GFP_KERNEL)
> -
>  static inline bool gfpflags_allow_blocking(const gfp_t gfp_flags)
>  {
>  	return !!(gfp_flags & __GFP_DIRECT_RECLAIM);
> diff --git a/include/linux/gfp_types.h b/include/linux/gfp_types.h
> index 190191411009..b1cd143f3c42 100644
> --- a/include/linux/gfp_types.h
> +++ b/include/linux/gfp_types.h
> @@ -382,4 +382,8 @@ enum {
>  			 __GFP_NOMEMALLOC | __GFP_NOWARN) & ~__GFP_RECLAIM)
>  #define GFP_TRANSHUGE	(GFP_TRANSHUGE_LIGHT | __GFP_DIRECT_RECLAIM)
>  
> +/* Helper macro to avoid gfp flags if they are the default one */
> +#define __default_gfp(a,b,...) b
> +#define default_gfp(...) __default_gfp(,##__VA_ARGS__,GFP_KERNEL)
> +
>  #endif /* __LINUX_GFP_TYPES_H */

Re: [PATCH 1/2] mm: Move default_gfp() into gfp_types.h

[Lorenzo Stoakes (ARM)]

On Mon, Sep 14, 2026 at 03:32:16PM -0700, Kees Cook wrote:
> Using default_gfp() only depends on the GFP_KERNEL value. Move
> default_gfp() into gfp_types.h so that future use in devres.h doesn't
> require pulling in all of gfp.h.
>
> Signed-off-by: Kees Cook <kees@kernel.org>

LGTM so:

Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

--
Cheers, Lorenzo

[PATCH 2/2] devres: Provide kmalloc_obj*-style API for devm_kmalloc

[Kees Cook]

Mirroring the type-based allocation now in use for the kmalloc family of
APIs, provide the same for the devm_kmalloc family of APIs. This will
allow for future plumbing of type information (e.g. alignment) into the
underlying allocations. This immediately gains type check on return
values (instead of the prior "void *" return type).

Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: <driver-core@lists.linux.dev>
Cc: <linux-hardening@vger.kernel.org>
---
 include/linux/device/devres.h | 102 ++++++++++++++++++++++++++++++++++
 1 file changed, 102 insertions(+)

diff --git a/include/linux/device/devres.h b/include/linux/device/devres.h
index 14ab9159bdda..7656c9ecd4da 100644
--- a/include/linux/device/devres.h
+++ b/include/linux/device/devres.h
@@ -62,6 +62,108 @@ static inline void *devm_kcalloc(struct device *dev, size_t n, size_t size, gfp_
 {
 	return devm_kmalloc_array(dev, n, size, flags | __GFP_ZERO);
 }
+
+/**
+ * __devm_alloc_objs - Device-managed allocation of objects of a given type
+ * @DEVM_ALLOC: which device-managed size-based allocator to use.
+ * @DEV: device to scope the allocation lifetime to.
+ * @GFP: GFP flags for the allocation.
+ * @TYPE: type to allocate space for.
+ * @COUNT: how many @TYPE objects to allocate.
+ *
+ * Device-managed counterpart of __alloc_objs().
+ * @DEVM_ALLOC takes (@DEV, size, gfp).
+ *
+ * Returns: Newly allocated pointer to (first) @TYPE of @COUNT-many allocated
+ * @TYPE objects, or NULL on failure.
+ */
+#define __devm_alloc_objs(DEVM_ALLOC, DEV, GFP, TYPE, COUNT)		\
+({									\
+	const size_t __obj_size = size_mul(sizeof(TYPE), COUNT);	\
+	(TYPE *)DEVM_ALLOC(DEV, __obj_size, GFP);			\
+})
+
+/**
+ * devm_kmalloc_obj - Device-managed allocation of a single typed object
+ * @DEV: Device to scope the allocation lifetime to.
+ * @VAR_OR_TYPE: Variable or type to allocate.
+ * @GFP: Optional GFP flags (defaults to %GFP_KERNEL).
+ *
+ * Device-managed counterpart of kmalloc_obj(): the allocation is sized from
+ * @VAR_OR_TYPE and returned as a pointer to that type, not void *.
+ *
+ * Returns: newly allocated pointer to a @VAR_OR_TYPE on success, or NULL on
+ * failure.
+ */
+#define devm_kmalloc_obj(DEV, VAR_OR_TYPE, ...)				\
+	__devm_alloc_objs(devm_kmalloc, DEV, default_gfp(__VA_ARGS__),	\
+			  typeof(VAR_OR_TYPE), 1)
+
+/**
+ * devm_kmalloc_objs - Device-managed allocation of an array of a typed object
+ * @DEV: Device to scope the allocation lifetime to.
+ * @VAR_OR_TYPE: Variable or type to allocate an array of.
+ * @COUNT: How many elements in the array.
+ * @GFP: Optional GFP flags (defaults to %GFP_KERNEL).
+ *
+ * Returns: newly allocated pointer to an array of @VAR_OR_TYPE on success, or
+ * NULL on failure (including when the total size overflows).
+ */
+#define devm_kmalloc_objs(DEV, VAR_OR_TYPE, COUNT, ...) \
+	__devm_alloc_objs(devm_kmalloc, DEV, default_gfp(__VA_ARGS__), \
+			  typeof(VAR_OR_TYPE), COUNT)
+
+/**
+ * __devm_alloc_flex - Device-managed allocation of a trailing-flex-array object
+ * @DEVM_ALLOC: which device-managed allocator to use.
+ * @DEV: device to scope the allocation lifetime to.
+ * @GFP: GFP flags for the allocation.
+ * @TYPE: type of structure to allocate space for.
+ * @FAM: name of the flexible array member of @TYPE.
+ * @COUNT: how many @FAM elements to allocate space for.
+ *
+ * Device-managed counterpart of __alloc_flex().
+ * @DEVM_ALLOC takes (@DEV, size, gfp).
+ *
+ * Returns: Newly allocated pointer to @TYPE with @COUNT-many trailing @FAM
+ * elements, or NULL on failure.
+ */
+#define __devm_alloc_flex(DEVM_ALLOC, DEV, GFP, TYPE, FAM, COUNT)	\
+({									\
+	const size_t __count = (COUNT);					\
+	const size_t __obj_size = struct_size_t(TYPE, FAM, __count);	\
+	TYPE *__obj_ptr = DEVM_ALLOC(DEV, __obj_size, GFP);		\
+	if (__obj_ptr)							\
+		__set_flex_counter(__obj_ptr->FAM, __count);		\
+	__obj_ptr;							\
+})
+
+/**
+ * devm_kmalloc_flex - Device-managed allocation of a flexible-array structure
+ * @DEV: Device to scope the allocation lifetime to.
+ * @VAR_OR_TYPE: Variable or type to allocate (with its flexible array).
+ * @FAM: The name of the flexible array member of the structure.
+ * @COUNT: How many flexible array member elements to allocate.
+ * @GFP: Optional GFP flags (defaults to %GFP_KERNEL).
+ *
+ * Returns: newly allocated pointer to @VAR_OR_TYPE on success, or NULL on
+ * failure. If @FAM has been annotated with __counted_by(), its counter is set
+ * to @COUNT.
+ */
+#define devm_kmalloc_flex(DEV, VAR_OR_TYPE, FAM, COUNT, ...) \
+	__devm_alloc_flex(devm_kmalloc, DEV, default_gfp(__VA_ARGS__), \
+			  typeof(VAR_OR_TYPE), FAM, COUNT)
+
+/* All devm_kzalloc aliases for devm_kmalloc_(obj|objs|flex). */
+#define devm_kzalloc_obj(DEV, P, ...) \
+	__devm_alloc_objs(devm_kzalloc, DEV, default_gfp(__VA_ARGS__), typeof(P), 1)
+#define devm_kzalloc_objs(DEV, P, COUNT, ...) \
+	__devm_alloc_objs(devm_kzalloc, DEV, default_gfp(__VA_ARGS__), \
+			  typeof(P), COUNT)
+#define devm_kzalloc_flex(DEV, P, FAM, COUNT, ...) \
+	__devm_alloc_flex(devm_kzalloc, DEV, default_gfp(__VA_ARGS__), \
+			  typeof(P), FAM, COUNT)
+
 static inline __realloc_size(3, 4) void * __must_check
 devm_krealloc_array(struct device *dev, void *p, size_t new_n, size_t new_size, gfp_t flags)
 {
-- 
2.34.1

Re: [PATCH 2/2] devres: Provide kmalloc_obj*-style API for devm_kmalloc

[Greg Kroah-Hartman]

On Mon, Sep 14, 2026 at 03:32:17PM -0700, Kees Cook wrote:
> Mirroring the type-based allocation now in use for the kmalloc family of
> APIs, provide the same for the devm_kmalloc family of APIs. This will
> allow for future plumbing of type information (e.g. alignment) into the
> underlying allocations. This immediately gains type check on return
> values (instead of the prior "void *" return type).
> 
> Signed-off-by: Kees Cook <kees@kernel.org>
> ---
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: "Rafael J. Wysocki" <rafael@kernel.org>
> Cc: Danilo Krummrich <dakr@kernel.org>
> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
> Cc: <driver-core@lists.linux.dev>
> Cc: <linux-hardening@vger.kernel.org>
> ---
>  include/linux/device/devres.h | 102 ++++++++++++++++++++++++++++++++++
>  1 file changed, 102 insertions(+)


I'm guessing you want this to go through your tree?  If so, that's
great:

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Otherwise let us know and we can take it through the driver core tree.

thanks,

greg k-h

Re: [PATCH 2/2] devres: Provide kmalloc_obj*-style API for devm_kmalloc

[Kees Cook]

On Mon, Oct 05, 2026 at 11:35:16PM +0200, Greg Kroah-Hartman wrote:
> On Mon, Sep 14, 2026 at 03:32:17PM -0700, Kees Cook wrote:
> > Mirroring the type-based allocation now in use for the kmalloc family of
> > APIs, provide the same for the devm_kmalloc family of APIs. This will
> > allow for future plumbing of type information (e.g. alignment) into the
> > underlying allocations. This immediately gains type check on return
> > values (instead of the prior "void *" return type).
> > 
> > Signed-off-by: Kees Cook <kees@kernel.org>
> > ---
> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > Cc: "Rafael J. Wysocki" <rafael@kernel.org>
> > Cc: Danilo Krummrich <dakr@kernel.org>
> > Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
> > Cc: <driver-core@lists.linux.dev>
> > Cc: <linux-hardening@vger.kernel.org>
> > ---
> >  include/linux/device/devres.h | 102 ++++++++++++++++++++++++++++++++++
> >  1 file changed, 102 insertions(+)
> 
> 
> I'm guessing you want this to go through your tree?  If so, that's
> great:
> 
> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Awesome; thank you! I'll get it into -next via the hardening tree.

-- 
Kees Cook

Re: [PATCH 2/2] devres: Provide kmalloc_obj*-style API for devm_kmalloc

[Danilo Krummrich]

On 15.09.26 00:32, Kees Cook wrote:
> Mirroring the type-based allocation now in use for the kmalloc family of
> APIs, provide the same for the devm_kmalloc family of APIs. This will
> allow for future plumbing of type information (e.g. alignment) into the
> underlying allocations. This immediately gains type check on return
> values (instead of the prior "void *" return type).
> 
> Signed-off-by: Kees Cook <kees@kernel.org>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>

Re: [PATCH 2/2] devres: Provide kmalloc_obj*-style API for devm_kmalloc

[Laurent Pinchart]

Hi Kees,

On Mon, Sep 14, 2026 at 03:32:17PM -0700, Kees Cook wrote:
> Mirroring the type-based allocation now in use for the kmalloc family of
> APIs, provide the same for the devm_kmalloc family of APIs. This will
> allow for future plumbing of type information (e.g. alignment) into the
> underlying allocations. This immediately gains type check on return
> values (instead of the prior "void *" return type).
> 
> Signed-off-by: Kees Cook <kees@kernel.org>
> ---
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: "Rafael J. Wysocki" <rafael@kernel.org>
> Cc: Danilo Krummrich <dakr@kernel.org>
> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
> Cc: <driver-core@lists.linux.dev>
> Cc: <linux-hardening@vger.kernel.org>
> ---
>  include/linux/device/devres.h | 102 ++++++++++++++++++++++++++++++++++
>  1 file changed, 102 insertions(+)
> 
> diff --git a/include/linux/device/devres.h b/include/linux/device/devres.h
> index 14ab9159bdda..7656c9ecd4da 100644
> --- a/include/linux/device/devres.h
> +++ b/include/linux/device/devres.h
> @@ -62,6 +62,108 @@ static inline void *devm_kcalloc(struct device *dev, size_t n, size_t size, gfp_
>  {
>  	return devm_kmalloc_array(dev, n, size, flags | __GFP_ZERO);
>  }
> +
> +/**
> + * __devm_alloc_objs - Device-managed allocation of objects of a given type
> + * @DEVM_ALLOC: which device-managed size-based allocator to use.
> + * @DEV: device to scope the allocation lifetime to.
> + * @GFP: GFP flags for the allocation.
> + * @TYPE: type to allocate space for.
> + * @COUNT: how many @TYPE objects to allocate.
> + *
> + * Device-managed counterpart of __alloc_objs().
> + * @DEVM_ALLOC takes (@DEV, size, gfp).
> + *
> + * Returns: Newly allocated pointer to (first) @TYPE of @COUNT-many allocated
> + * @TYPE objects, or NULL on failure.
> + */
> +#define __devm_alloc_objs(DEVM_ALLOC, DEV, GFP, TYPE, COUNT)		\
> +({									\
> +	const size_t __obj_size = size_mul(sizeof(TYPE), COUNT);	\
> +	(TYPE *)DEVM_ALLOC(DEV, __obj_size, GFP);			\
> +})
> +
> +/**
> + * devm_kmalloc_obj - Device-managed allocation of a single typed object
> + * @DEV: Device to scope the allocation lifetime to.
> + * @VAR_OR_TYPE: Variable or type to allocate.
> + * @GFP: Optional GFP flags (defaults to %GFP_KERNEL).
> + *
> + * Device-managed counterpart of kmalloc_obj(): the allocation is sized from
> + * @VAR_OR_TYPE and returned as a pointer to that type, not void *.
> + *
> + * Returns: newly allocated pointer to a @VAR_OR_TYPE on success, or NULL on
> + * failure.
> + */
> +#define devm_kmalloc_obj(DEV, VAR_OR_TYPE, ...)				\
> +	__devm_alloc_objs(devm_kmalloc, DEV, default_gfp(__VA_ARGS__),	\
> +			  typeof(VAR_OR_TYPE), 1)
> +
> +/**
> + * devm_kmalloc_objs - Device-managed allocation of an array of a typed object
> + * @DEV: Device to scope the allocation lifetime to.
> + * @VAR_OR_TYPE: Variable or type to allocate an array of.
> + * @COUNT: How many elements in the array.
> + * @GFP: Optional GFP flags (defaults to %GFP_KERNEL).
> + *
> + * Returns: newly allocated pointer to an array of @VAR_OR_TYPE on success, or
> + * NULL on failure (including when the total size overflows).
> + */
> +#define devm_kmalloc_objs(DEV, VAR_OR_TYPE, COUNT, ...) \
> +	__devm_alloc_objs(devm_kmalloc, DEV, default_gfp(__VA_ARGS__), \
> +			  typeof(VAR_OR_TYPE), COUNT)
> +
> +/**
> + * __devm_alloc_flex - Device-managed allocation of a trailing-flex-array object
> + * @DEVM_ALLOC: which device-managed allocator to use.
> + * @DEV: device to scope the allocation lifetime to.
> + * @GFP: GFP flags for the allocation.
> + * @TYPE: type of structure to allocate space for.
> + * @FAM: name of the flexible array member of @TYPE.
> + * @COUNT: how many @FAM elements to allocate space for.
> + *
> + * Device-managed counterpart of __alloc_flex().
> + * @DEVM_ALLOC takes (@DEV, size, gfp).
> + *
> + * Returns: Newly allocated pointer to @TYPE with @COUNT-many trailing @FAM
> + * elements, or NULL on failure.
> + */
> +#define __devm_alloc_flex(DEVM_ALLOC, DEV, GFP, TYPE, FAM, COUNT)	\
> +({									\
> +	const size_t __count = (COUNT);					\
> +	const size_t __obj_size = struct_size_t(TYPE, FAM, __count);	\
> +	TYPE *__obj_ptr = DEVM_ALLOC(DEV, __obj_size, GFP);		\
> +	if (__obj_ptr)							\
> +		__set_flex_counter(__obj_ptr->FAM, __count);		\
> +	__obj_ptr;							\
> +})
> +
> +/**
> + * devm_kmalloc_flex - Device-managed allocation of a flexible-array structure
> + * @DEV: Device to scope the allocation lifetime to.
> + * @VAR_OR_TYPE: Variable or type to allocate (with its flexible array).
> + * @FAM: The name of the flexible array member of the structure.
> + * @COUNT: How many flexible array member elements to allocate.
> + * @GFP: Optional GFP flags (defaults to %GFP_KERNEL).
> + *
> + * Returns: newly allocated pointer to @VAR_OR_TYPE on success, or NULL on
> + * failure. If @FAM has been annotated with __counted_by(), its counter is set
> + * to @COUNT.
> + */
> +#define devm_kmalloc_flex(DEV, VAR_OR_TYPE, FAM, COUNT, ...) \
> +	__devm_alloc_flex(devm_kmalloc, DEV, default_gfp(__VA_ARGS__), \
> +			  typeof(VAR_OR_TYPE), FAM, COUNT)
> +
> +/* All devm_kzalloc aliases for devm_kmalloc_(obj|objs|flex). */
> +#define devm_kzalloc_obj(DEV, P, ...) \
> +	__devm_alloc_objs(devm_kzalloc, DEV, default_gfp(__VA_ARGS__), typeof(P), 1)
> +#define devm_kzalloc_objs(DEV, P, COUNT, ...) \
> +	__devm_alloc_objs(devm_kzalloc, DEV, default_gfp(__VA_ARGS__), \
> +			  typeof(P), COUNT)

I was recently made aware by Geert of an unfortunate side effect of the
default GPF_KERNEL argument. I've fixed a memory leak in the imx8-isi
driver by using devm_kzalloc_objs() as follows:

diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
index 0ae5f35e017c..9373a5256224 100644
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
@@ -488,7 +488,8 @@ static int mxc_isi_probe(struct platform_device *pdev)

 	isi->pdata = of_device_get_match_data(dev);

-	isi->pipes = kzalloc_objs(isi->pipes[0], isi->pdata->num_channels);
+	isi->pipes = devm_kzalloc_objs(dev, isi->pipes[0],
+				       isi->pdata->num_channels);
 	if (!isi->pipes)
 		return -ENOMEM;

So far, so good. However, the following code also compiles:

	isi->pipes = devm_kzalloc_obj(dev, isi->pipes[0],
				      isi->pdata->num_channels);

(note the *obj* instead of *objs*) because the third argument is
interpreted as gfp flags. It's clearly a bug, but one that the compiler
doesn't catch. The typo is easy to make.

Sparse catches the issue:

drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:491:22: warning: incorrect type in argument 3 (different base types)
drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:491:22:    expected restricted gfp_t [usertype] gfp
drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:491:22:    got unsigned int const num_channels

I'm however not sure if build bots report sparse warnings or only
errors.

Is this an issue you're aware of, and do you think it should be
addressed ?

> +#define devm_kzalloc_flex(DEV, P, FAM, COUNT, ...) \
> +	__devm_alloc_flex(devm_kzalloc, DEV, default_gfp(__VA_ARGS__), \
> +			  typeof(P), FAM, COUNT)
> +
>  static inline __realloc_size(3, 4) void * __must_check
>  devm_krealloc_array(struct device *dev, void *p, size_t new_n, size_t new_size, gfp_t flags)
>  {

-- 
Regards,

Laurent Pinchart

Re: [PATCH 2/2] devres: Provide kmalloc_obj*-style API for devm_kmalloc

[Alejandro Colomar]

[-- Attachment #1: Type: text/plain, Size: 5742 bytes --]

[CC += Linus]

Hi Laurent, Linus,

> Date: 2026-11-12 02:40:39+0200
> From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
>
> Hi Kees,
> 
> On Mon, Sep 14, 2026 at 03:32:17PM -0700, Kees Cook wrote:
> > Mirroring the type-based allocation now in use for the kmalloc family of
> > APIs, provide the same for the devm_kmalloc family of APIs. This will
> > allow for future plumbing of type information (e.g. alignment) into the
> > underlying allocations. This immediately gains type check on return
> > values (instead of the prior "void *" return type).
> > 
> > Signed-off-by: Kees Cook <kees@kernel.org>
> > ---
> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > Cc: "Rafael J. Wysocki" <rafael@kernel.org>
> > Cc: Danilo Krummrich <dakr@kernel.org>
> > Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
> > Cc: <driver-core@lists.linux.dev>
> > Cc: <linux-hardening@vger.kernel.org>
> > ---
> >  include/linux/device/devres.h | 102 ++++++++++++++++++++++++++++++++++
> >  1 file changed, 102 insertions(+)
> > 
[...]
> > +#define devm_kmalloc_flex(DEV, VAR_OR_TYPE, FAM, COUNT, ...) \
> > +	__devm_alloc_flex(devm_kmalloc, DEV, default_gfp(__VA_ARGS__), \
> > +			  typeof(VAR_OR_TYPE), FAM, COUNT)
> > +
> > +/* All devm_kzalloc aliases for devm_kmalloc_(obj|objs|flex). */
> > +#define devm_kzalloc_obj(DEV, P, ...) \
> > +	__devm_alloc_objs(devm_kzalloc, DEV, default_gfp(__VA_ARGS__), typeof(P), 1)
> > +#define devm_kzalloc_objs(DEV, P, COUNT, ...) \
> > +	__devm_alloc_objs(devm_kzalloc, DEV, default_gfp(__VA_ARGS__), \
> > +			  typeof(P), COUNT)
> 
> I was recently made aware by Geert of an unfortunate side effect of the
> default GPF_KERNEL argument. I've fixed a memory leak in the imx8-isi
> driver by using devm_kzalloc_objs() as follows:
> 
> diff --git a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> index 0ae5f35e017c..9373a5256224 100644
> --- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> +++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c
> @@ -488,7 +488,8 @@ static int mxc_isi_probe(struct platform_device *pdev)
> 
>  	isi->pdata = of_device_get_match_data(dev);
> 
> -	isi->pipes = kzalloc_objs(isi->pipes[0], isi->pdata->num_channels);
> +	isi->pipes = devm_kzalloc_objs(dev, isi->pipes[0],
> +				       isi->pdata->num_channels);
>  	if (!isi->pipes)
>  		return -ENOMEM;
> 
> So far, so good. However, the following code also compiles:
> 
> 	isi->pipes = devm_kzalloc_obj(dev, isi->pipes[0],
> 				      isi->pdata->num_channels);
> 
> (note the *obj* instead of *objs*) because the third argument is
> interpreted as gfp flags. It's clearly a bug, but one that the compiler
> doesn't catch. The typo is easy to make.
> 
> Sparse catches the issue:
> 
> drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:491:22: warning: incorrect type in argument 3 (different base types)
> drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:491:22:    expected restricted gfp_t [usertype] gfp
> drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c:491:22:    got unsigned int const num_channels
> 
> I'm however not sure if build bots report sparse warnings or only
> errors.
> 
> Is this an issue you're aware of, and do you think it should be
> addressed ?

Indeed, this is a known problem of these macros.  I reported it in March:
<https://lore.kernel.org/lkml/abhGS0n_RsUG97Ni@devuan/>

The link contains a detailed report of the issue, and why it happens.

There is not a single cause of this bug, but rather a combination of
several of them.

I suggest removing kmalloc_obj() entirely, and using kmalloc_objs()
always, with a second argument of 1 when we want a single object.  This
would remove the risk of that typo.  That is, instead of:

    int *p = kmalloc_objs(int, 42);
    int *q = kmalloc_obj(int);

we should do

    int *p = kmalloc_objs(int, 42);
    int *q = kmalloc_objs(int, 1);

I also suggest having default arguments without variadic macros.  The
way to do that is using empty arguments.  Linus complained that it hurts
his eyes, but it really makes these macros much safer.

That is, instead of

	int *p = kmalloc_objs(int, 42);

we should do

	int *p = kmalloc_objs(int, 42,);

By having an explicitly empty third parameter, we'd be asking explicitly
for the default value, which the compiler can verify, compared to having
to guess whether we asked for it or we just forgot about its existence.

Any of these two changes would already reduce the chances of this bug
significantly, but if we apply both, it's almost impossible to have it.

Another issue with that macro is accepting an expression instead of a
type name.  Consider the following mistake:

    p = kmalloc_objs(42, *p);

The compiler can't catch that we swapped the order of arguments
accidentally, and will allocate a wrong number of objects (whatever
happens to be in *p, if already initialized, else we might be lucky and
get an uninitialized diagnostic).  If we require that the first
parameter is a type name, it will preclude that problem.

Please let me know if any of these changes is wanted, and I can prepare
some patches.


Have a lovely day!
Alex

> 
> > +#define devm_kzalloc_flex(DEV, P, FAM, COUNT, ...) \
> > +	__devm_alloc_flex(devm_kzalloc, DEV, default_gfp(__VA_ARGS__), \
> > +			  typeof(P), FAM, COUNT)
> > +
> >  static inline __realloc_size(3, 4) void * __must_check
> >  devm_krealloc_array(struct device *dev, void *p, size_t new_n, size_t new_size, gfp_t flags)
> >  {
> 
> -- 
> Regards,
> 
> Laurent Pinchart
> 

-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]