Re: [GIT PULL] kmalloc_obj treewide refactor for v7.0-rc1

Kees Cook
2026-02-21T22:43:37Z

On Sat, Feb 21, 2026 at 02:33:16PM -0800, Linus Torvalds wrote:
> it it has decided that the flush_backlogs_alloc() call should result
> in an unconditional WARN_ON(). The string associated with that
> WARN_ON() is
>
> overflows_flex_counter_type(typeof(struct flush_backlogs), w, __count)
>
> which I guess is not surprising: that's exactly what that
>
> kmalloc_flex(struct flush_backlogs, w, nr_cpu_ids, GFP_KERNEL);
>
> change would do.
>
> So in clang's world, the code that follows - that sets
> 'dev_boot_phase' to zero among other things - never happens, because
> that kmalloc_flex() unconditionally returns NULL after the warning.

UUUuuuuggh.

> I do not think this is fixable. I complained about the overly
> complicated macros earlier, and suggested you only do the minimal and
> obvious kmalloc_obj() without any of the flex crap.

How about this, then?

diff --git a/include/linux/slab.h b/include/linux/slab.h
index c5fde8740281..1270320b59c8 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -1003,11 +1003,7 @@ void *kmalloc_nolock_noprof(size_t size, gfp_t gfp_flags, int node);
({ \
const size_t __count = (COUNT); \
const size_t __obj_size = struct_size_t(TYPE, FAM, __count); \
- TYPE *__obj_ptr; \
- if (WARN_ON_ONCE(overflows_flex_counter_type(TYPE, FAM, __count))) \
- __obj_ptr = NULL; \
- else \
- __obj_ptr = KMALLOC(__obj_size, GFP); \
+ TYPE *__obj_ptr = KMALLOC(__obj_size, GFP); \
if (__obj_ptr) \
__set_flex_counter(__obj_ptr->FAM, __count); \
__obj_ptr; \

I'll go see if that helps.

-Kees

--
Kees Cook