* [PATCH 1/2] mtd: virt_concat: use single allocation for node
2026-03-04 22:15 [PATCH 0/2] mtd: concat: use flex array Rosen Penev
@ 2026-03-04 22:15 ` Rosen Penev
2026-03-05 7:08 ` Philipp Matthias Hahn
2026-03-04 22:15 ` [PATCH 2/2] mtd: concat: replace alloc + calloc with 1 alloc Rosen Penev
1 sibling, 1 reply; 5+ messages in thread
From: Rosen Penev @ 2026-03-04 22:15 UTC (permalink / raw)
To: linux-mtd
Cc: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra, Kees Cook,
Gustavo A. R. Silva, open list,
open list:KERNEL HARDENING (not covered by other areas):Keyword:b__counted_by(_le|_be)?b
Simpler to reason about and avoids having to free nodes separately.
Also add __counted_by attribute for extra runtime analysis.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/mtd/mtd_virt_concat.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/drivers/mtd/mtd_virt_concat.c b/drivers/mtd/mtd_virt_concat.c
index aea88d1c9bc5..89e223edac6a 100644
--- a/drivers/mtd/mtd_virt_concat.c
+++ b/drivers/mtd/mtd_virt_concat.c
@@ -31,8 +31,8 @@ static LIST_HEAD(concat_node_list);
struct mtd_virt_concat_node {
struct list_head head;
unsigned int count;
- struct device_node **nodes;
struct mtd_concat *concat;
+ struct device_node *nodes[] __counted_by(nodes);
};
/**
@@ -133,7 +133,6 @@ int mtd_virt_concat_destroy(struct mtd_info *mtd)
for (idx = 0; idx < item->count; idx++)
of_node_put(item->nodes[idx]);
- kfree(item->nodes);
kfree(item);
}
return 0;
@@ -167,16 +166,11 @@ static int mtd_virt_concat_create_item(struct device_node *parts,
return 0;
}
- item = kzalloc(sizeof(*item), GFP_KERNEL);
+ item = kzalloc_flex(*item, nodes, count, GFP_KERNEL);
if (!item)
return -ENOMEM;
item->count = count;
- item->nodes = kcalloc(count, sizeof(*item->nodes), GFP_KERNEL);
- if (!item->nodes) {
- kfree(item);
- return -ENOMEM;
- }
/*
* The partition in which "part-concat-next" property
@@ -216,7 +210,6 @@ void mtd_virt_concat_destroy_items(void)
for (i = 0; i < item->count; i++)
of_node_put(item->nodes[i]);
- kfree(item->nodes);
kfree(item);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 2/2] mtd: concat: replace alloc + calloc with 1 alloc
2026-03-04 22:15 [PATCH 0/2] mtd: concat: use flex array Rosen Penev
2026-03-04 22:15 ` [PATCH 1/2] mtd: virt_concat: use single allocation for node Rosen Penev
@ 2026-03-04 22:15 ` Rosen Penev
1 sibling, 0 replies; 5+ messages in thread
From: Rosen Penev @ 2026-03-04 22:15 UTC (permalink / raw)
To: linux-mtd
Cc: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra, Kees Cook,
Gustavo A. R. Silva, open list,
open list:KERNEL HARDENING (not covered by other areas):Keyword:b__counted_by(_le|_be)?b
A flex array can be used to reduce the allocation to 1.
And actually mtdconcat was using the pointer + 1 trick to point to the
overallocated area. Better alternatives exist.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/mtd/mtd_virt_concat.c | 10 ++--------
drivers/mtd/mtdconcat.c | 5 +----
include/linux/mtd/concat.h | 2 +-
3 files changed, 4 insertions(+), 13 deletions(-)
diff --git a/drivers/mtd/mtd_virt_concat.c b/drivers/mtd/mtd_virt_concat.c
index 89e223edac6a..b56f2431974b 100644
--- a/drivers/mtd/mtd_virt_concat.c
+++ b/drivers/mtd/mtd_virt_concat.c
@@ -32,7 +32,7 @@ struct mtd_virt_concat_node {
struct list_head head;
unsigned int count;
struct mtd_concat *concat;
- struct device_node *nodes[] __counted_by(nodes);
+ struct device_node *nodes[] __counted_by(count);
};
/**
@@ -182,18 +182,12 @@ static int mtd_virt_concat_create_item(struct device_node *parts,
for (i = 1; i < count; i++)
item->nodes[i] = of_parse_phandle(parts, CONCAT_PROP, (i - 1));
- concat = kzalloc(sizeof(*concat), GFP_KERNEL);
+ concat = kzalloc_flex(*concat, subdev, count, GFP_KERNEL);
if (!concat) {
kfree(item);
return -ENOMEM;
}
- concat->subdev = kcalloc(count, sizeof(*concat->subdev), GFP_KERNEL);
- if (!concat->subdev) {
- kfree(item);
- kfree(concat);
- return -ENOMEM;
- }
item->concat = concat;
list_add_tail(&item->head, &concat_node_list);
diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 241d15235d01..c97167d51fe2 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -627,7 +627,6 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c
const char *name)
{ /* name for the new device */
int i;
- size_t size;
struct mtd_concat *concat;
struct mtd_info *subdev_master = NULL;
uint32_t max_erasesize, curr_erasesize;
@@ -640,15 +639,13 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c
printk(KERN_NOTICE "into device \"%s\"\n", name);
/* allocate the device structure */
- size = SIZEOF_STRUCT_MTD_CONCAT(num_devs);
- concat = kzalloc(size, GFP_KERNEL);
+ concat = kzalloc_flex(*concat, subdev, num_devs, GFP_KERNEL);
if (!concat) {
printk
("memory allocation error while creating concatenated device \"%s\"\n",
name);
return NULL;
}
- concat->subdev = (struct mtd_info **) (concat + 1);
/*
* Set up the new "super" device's MTD object structure, check for
diff --git a/include/linux/mtd/concat.h b/include/linux/mtd/concat.h
index 2cd9d48958a8..f8d4d6ac1fc1 100644
--- a/include/linux/mtd/concat.h
+++ b/include/linux/mtd/concat.h
@@ -18,7 +18,7 @@
struct mtd_concat {
struct mtd_info mtd;
int num_subdev;
- struct mtd_info **subdev;
+ struct mtd_info *subdev[];
};
struct mtd_info *mtd_concat_create(
--
2.53.0
^ permalink raw reply related [flat|nested] 5+ messages in thread