compiler_types: Disable __builtin_counted_by_ref for Clang

Unfortunately, there is a corner case of __builtin_counted_by_ref()
usage that crashes[1] Clang since support was introduced in Clang 19.
Disable it prior to Clang 22. Found while tested kmalloc_obj treewide
refactoring (via kmalloc_flex() usage).

Link: https://github.com/llvm/llvm-project/issues/182575 [1]
Signed-off-by: Kees Cook <kees@kernel.org>

include/linux/compiler_types.h

@@ -552,7 +552,8 @@ struct ftrace_likely_data {
  *   gcc: https://gcc.gnu.org/onlinedocs/gcc/Other-Builtins.html#index-_005f_005fbuiltin_005fcounted_005fby_005fref
  * clang: https://clang.llvm.org/docs/LanguageExtensions.html#builtin-counted-by-ref
  */
-#if __has_builtin(__builtin_counted_by_ref)
+#if __has_builtin(__builtin_counted_by_ref) && \
+    !defined(CONFIG_CC_HAS_BROKEN_COUNTED_BY_REF)
 /**
  * __flex_counter() - Get pointer to counter member for the given
  *                    flexible array, if it was annotated with __counted_by()

init/Kconfig

@@ -150,6 +150,11 @@ config CC_HAS_COUNTED_BY_PTR
 	# supported since gcc 16.0.0
 	default y if CC_IS_GCC && GCC_VERSION >= 160000
 
+config CC_HAS_BROKEN_COUNTED_BY_REF
+	bool
+	# https://github.com/llvm/llvm-project/issues/182575
+	default y if CC_IS_CLANG && CLANG_VERSION < 220000
+
 config CC_HAS_MULTIDIMENSIONAL_NONSTRING
 	def_bool $(success,echo 'char tag[][4] __attribute__((__nonstring__)) = { };' | $(CC) $(CLANG_FLAGS) -x c - -c -o /dev/null -Werror)