Re: [GIT PULL] kmalloc_obj treewide refactor for v7.0-rc1

[Kees Cook <kees@kernel.org>]

On Sat, Feb 21, 2026 at 02:33:16PM -0800, Linus Torvalds wrote:
> it it has decided that the flush_backlogs_alloc() call should result
> in an unconditional WARN_ON(). The string associated with that
> WARN_ON() is
> 
>      overflows_flex_counter_type(typeof(struct flush_backlogs), w, __count)
> 
> which I guess is not surprising: that's exactly what that
> 
>         kmalloc_flex(struct flush_backlogs, w, nr_cpu_ids, GFP_KERNEL);
> 
> change would do.
> 
> So in clang's world, the code that follows - that sets
> 'dev_boot_phase' to zero among other things - never happens, because
> that kmalloc_flex() unconditionally returns NULL after the warning.

UUUuuuuggh.

> I do not think this is fixable. I complained about the overly
> complicated macros earlier, and suggested you only do the minimal and
> obvious kmalloc_obj() without any of the flex crap.

How about this, then?

diff --git a/include/linux/slab.h b/include/linux/slab.h
index c5fde8740281..1270320b59c8 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -1003,11 +1003,7 @@ void *kmalloc_nolock_noprof(size_t size, gfp_t gfp_flags, int node);
 ({									\
 	const size_t __count = (COUNT);					\
 	const size_t __obj_size = struct_size_t(TYPE, FAM, __count);	\
-	TYPE *__obj_ptr;						\
-	if (WARN_ON_ONCE(overflows_flex_counter_type(TYPE, FAM,	__count))) \
-		__obj_ptr = NULL;					\
-	else								\
-		__obj_ptr = KMALLOC(__obj_size, GFP);			\
+	TYPE *__obj_ptr = KMALLOC(__obj_size, GFP);			\
 	if (__obj_ptr)							\
 		__set_flex_counter(__obj_ptr->FAM, __count);		\
 	__obj_ptr;							\


I'll go see if that helps.

-Kees

-- 
Kees Cook