Re: [PATCH v4 4/6] stddef: Add const_cast()

[Alejandro Colomar <alx+linux-hardening@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 2147 bytes --]

Hi David,

> Date: 2026-11-11 20:55:39+0100
> From: Alejandro Colomar <alx@kernel.org>
>
> This macro serves to cast const away without risking unwanted
> conversions due to mistakes in the cast.
> 
> It's similar to C++'s const_cast(), but it is more restrictive: it can
> only cast away 'const', and not arbitrary qualifiers.
> 
> David made it a bit more robust.
> 
> Link: https://lore.kernel.org/linux-hardening/20261111102535.434c2eee@pumpkin/
> Co-developed-by: David Laight <david.laight.linux@gmail.com>
> Signed-off-by: Alejandro Colomar <alx@kernel.org>
> ---
>  include/linux/stddef.h | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/include/linux/stddef.h b/include/linux/stddef.h
> index e1851c50c89b..5201d71db387 100644
> --- a/include/linux/stddef.h
> +++ b/include/linux/stddef.h
> @@ -194,4 +194,16 @@ enum {
>  #define TRAILING_OVERLAP(TYPE, NAME, FAM, MEMBERS)				\
>  	__TRAILING_OVERLAP(TYPE, NAME, FAM, /* no attrs */, MEMBERS)
>  
> +/**
> + * const_cast() - At most, drop const in the left-most derivation of a pointer
> + *
> + * @T: Type for the cast.
> + * @p: Pointer to be casted.
> + *
> + * If @p is of type const @T, then it is casted to @T.
> + * If @p is of type @T, then it is returned without any casts.
> + * This avoids mistakes that change anything other than 'const' in a cast.
> + */
> +#define const_cast(T, p)  _Generic(p, const T: (T) (p), T: (p))

Ouch!  I _thought_ I had built with this already, but I might have done
something wrong.  Trying to build now, it fails to compile.  Which
reminds me why I used 'default:' in the first place: when T is the same
type as const T, this fails to build, because _Generic() can't have two
identical selectors.

So, indeed, we need default:.  It's not a big problem, because since
the type T is already validated by the function itself: it T is not
something that can be passed to strprefix()'s first parameter, it will
fail to compile.

So, I'll revert this in v5.


Have a lovely night!
Alex

> +
>  #endif
> -- 
> 2.55.0
> 



-- 
<https://www.alejandro-colomar.es>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]