Re: [PATCH v3] slab: Introduce kmalloc_obj() and family

[Przemek Kitszel <przemyslaw.kitszel@intel.com>]

On 8/23/24 01:13, Kees Cook wrote:

> (...) For cases where the total size of the allocation is needed,
> the kmalloc_obj_sz(), kmalloc_objs_sz(), and kmalloc_flex_sz() family
> of macros can be used. For example:
> 
> 	info->size = struct_size(ptr, flex_member, count);
> 	ptr = kmalloc(info->size, gfp);
> 
> becomes:
> 
> 	kmalloc_flex_sz(ptr, flex_member, count, gfp, &info->size);
> 
> Internal introspection of allocated type now becomes possible, allowing
> for future alignment-aware choices and hardening work. For example,
> adding __alignof(*ptr) as an argument to the internal allocators so that
> appropriate/efficient alignment choices can be made, or being able to
> correctly choose per-allocation offset randomization within a bucket
> that does not break alignment requirements.
> 
> Introduces __flex_count() for when __builtin_get_counted_by() is added
> by GCC[1] and Clang[2]. The internal use of __flex_count() allows for
> automatically setting the counter member of a struct's flexible array
> member when it has been annotated with __counted_by(), avoiding any
> missed early size initializations while __counted_by() annotations are
> added to the kernel. Additionally, this also checks for "too large"
> allocations based on the type size of the counter variable. For example:
> 
> 	if (count > type_max(ptr->flex_count))
> 		fail...;
> 	info->size = struct_size(ptr, flex_member, count);
> 	ptr = kmalloc(info->size, gfp);
> 	ptr->flex_count = count;
> 
> becomes (i.e. unchanged from earlier example):
> 
> 	kmalloc_flex_sz(ptr, flex_member, count, gfp, &info->size);

As there could be no __builtin_get_counted_by() available, caller still
needs to fill the counted-by variable, right? So it is possible to just
pass the in the struct pointer to fill? (last argument "&f->cnt" of the
snippet below):

struct foo {
	int cnt;
	struct bar[] __counted_by(cnt);
};

//...
	struct foo *f;

	kmalloc_flex_sz(f, cnt, 42, gfp, &f->cnt);