Re: [PATCH] drm: dp_tunnel: use kzalloc_flex

["Ville Syrjälä" <ville.syrjala@linux.intel.com>]

On Sun, Mar 08, 2026 at 02:12:20PM -0700, Rosen Penev wrote:
> Simplifies allocation by using a flexible array member to remove a
> second kzalloc.
> 
> Added __counted_by for extra runtime analysis.
> 
> Simplify assignment loop. It always returns true. That is,
> max_group_count is always equal to group_count.
> 
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
>  drivers/gpu/drm/display/drm_dp_tunnel.c | 26 ++++++-------------------
>  1 file changed, 6 insertions(+), 20 deletions(-)
> 
> diff --git a/drivers/gpu/drm/display/drm_dp_tunnel.c b/drivers/gpu/drm/display/drm_dp_tunnel.c
> index f442430d8de7..aad1605b956e 100644
> --- a/drivers/gpu/drm/display/drm_dp_tunnel.c
> +++ b/drivers/gpu/drm/display/drm_dp_tunnel.c
> @@ -188,13 +188,13 @@ struct drm_dp_tunnel_group {
>  struct drm_dp_tunnel_mgr {
>  	struct drm_device *dev;
>  
> -	int group_count;
> -	struct drm_dp_tunnel_group *groups;
>  	wait_queue_head_t bw_req_queue;
>  
>  #ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG
>  	struct ref_tracker_dir ref_tracker;
>  #endif
> +	int group_count;
> +	struct drm_dp_tunnel_group groups[] __counted_by(group_count);
>  };
>  
>  /*
> @@ -1893,7 +1893,6 @@ static void destroy_mgr(struct drm_dp_tunnel_mgr *mgr)
>  	ref_tracker_dir_exit(&mgr->ref_tracker);
>  #endif
>  
> -	kfree(mgr->groups);
>  	kfree(mgr);
>  }
>  
> @@ -1913,33 +1912,20 @@ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count)
>  	struct drm_dp_tunnel_mgr *mgr;
>  	int i;
>  
> -	mgr = kzalloc_obj(*mgr);
> +	mgr = kzalloc_flex(*mgr, groups, max_group_count);
>  	if (!mgr)
>  		return ERR_PTR(-ENOMEM);
>  
> +	mgr->group_count = max_group_count;
>  	mgr->dev = dev;
>  	init_waitqueue_head(&mgr->bw_req_queue);
>  
> -	mgr->groups = kzalloc_objs(*mgr->groups, max_group_count);
> -	if (!mgr->groups) {
> -		kfree(mgr);
> -
> -		return ERR_PTR(-ENOMEM);
> -	}
> -
>  #ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG
>  	ref_tracker_dir_init(&mgr->ref_tracker, 16, "drm_dptun");
>  #endif
>  
> -	for (i = 0; i < max_group_count; i++) {
> -		if (!init_group(mgr, &mgr->groups[i])) {
> -			destroy_mgr(mgr);
> -
> -			return ERR_PTR(-ENOMEM);
> -		}
> -
> -		mgr->group_count++;
> -	}
> +	for (i = 0; i < max_group_count; i++)
> +		init_group(mgr, &mgr->groups[i]);

This breaks the error handling.

Hmm, actually it looks like it already got broken by commit
8e6da25bd60d ("drm/dp_tunnel: Switch private_obj initialization
to atomic_create_state")...

>  
>  	return mgr;
>  }
> -- 
> 2.53.0

-- 
Ville Syrjälä
Intel