public inbox for linux-media@vger.kernel.org
 help / color / mirror / Atom feed
From: Rosen Penev <rosenp@gmail.com>
To: linux-media@vger.kernel.org
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>,
	Kees Cook <kees@kernel.org>,
	"Gustavo A. R. Silva" <gustavoars@kernel.org>,
	linux-kernel@vger.kernel.org (open list),
	linux-hardening@vger.kernel.org (open list:KERNEL HARDENING (not
	covered by other areas):Keyword:\b__counted_by(_le|_be)?\b)
Subject: [PATCH] media: em28xx: kzalloc + kcalloc to kzalloc_flex
Date: Thu, 19 Mar 2026 18:02:12 -0700	[thread overview]
Message-ID: <20260320010212.31425-1-rosenp@gmail.com> (raw)

There's no need to allocate these separately.

Add __counted_by for extra runtime analysis. Moved counting variable
allocation to right after allocation as required by __counted_by.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/media/usb/em28xx/em28xx-cards.c | 18 ++----------------
 drivers/media/usb/em28xx/em28xx.h       |  3 ++-
 2 files changed, 4 insertions(+), 17 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index d7075ebabceb..c278e48b3428 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -3567,9 +3567,6 @@ void em28xx_free_device(struct kref *ref)
 	if (!dev->disconnected)
 		em28xx_release_resources(dev);
 
-	if (dev->ts == PRIMARY_TS)
-		kfree(dev->alt_max_pkt_size_isoc);
-
 	kfree(dev);
 }
 EXPORT_SYMBOL_GPL(em28xx_free_device);
@@ -3912,21 +3909,13 @@ static int em28xx_usb_probe(struct usb_interface *intf,
 	}
 
 	/* allocate memory for our device state and initialize it */
-	dev = kzalloc_obj(*dev);
+	dev = kzalloc_flex(*dev, alt_max_pkt_size_isoc, intf->num_altsetting);
 	if (!dev) {
 		retval = -ENOMEM;
 		goto err;
 	}
 
-	/* compute alternate max packet sizes */
-	dev->alt_max_pkt_size_isoc = kcalloc(intf->num_altsetting,
-					     sizeof(dev->alt_max_pkt_size_isoc[0]),
-					     GFP_KERNEL);
-	if (!dev->alt_max_pkt_size_isoc) {
-		kfree(dev);
-		retval = -ENOMEM;
-		goto err;
-	}
+	dev->num_alt = intf->num_altsetting;
 
 	/* Get endpoints */
 	for (i = 0; i < intf->num_altsetting; i++) {
@@ -4028,8 +4017,6 @@ static int em28xx_usb_probe(struct usb_interface *intf,
 			dev->dvb_ep_bulk ? " bulk" : "",
 			dev->dvb_ep_isoc ? " isoc" : "");
 
-	dev->num_alt = intf->num_altsetting;
-
 	if ((unsigned int)card[nr] < em28xx_bcount)
 		dev->model = card[nr];
 
@@ -4163,7 +4150,6 @@ static int em28xx_usb_probe(struct usb_interface *intf,
 	return 0;
 
 err_free:
-	kfree(dev->alt_max_pkt_size_isoc);
 	kfree(dev);
 
 err:
diff --git a/drivers/media/usb/em28xx/em28xx.h b/drivers/media/usb/em28xx/em28xx.h
index f3449c240d21..1c2f92927889 100644
--- a/drivers/media/usb/em28xx/em28xx.h
+++ b/drivers/media/usb/em28xx/em28xx.h
@@ -730,7 +730,6 @@ struct em28xx {
 	int packet_multiplier;	// multiplier for wMaxPacketSize, used for
 				// URB buffer size definition
 	int num_alt;		// number of alternative settings
-	unsigned int *alt_max_pkt_size_isoc; // array of isoc wMaxPacketSize
 	unsigned int analog_xfer_bulk:1;	// use bulk instead of isoc
 						// transfers for analog
 	int dvb_alt_isoc;	// alternate setting for DVB isoc transfers
@@ -772,6 +771,8 @@ struct em28xx {
 
 	struct em28xx	*dev_next;
 	int ts;
+
+	unsigned int alt_max_pkt_size_isoc[] __counted_by(num_alt); // array of isoc wMaxPacketSize
 };
 
 #define kref_to_dev(d) container_of(d, struct em28xx, ref)
-- 
2.53.0


             reply	other threads:[~2026-03-20  1:02 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-03-20  1:02 Rosen Penev [this message]
2026-03-20 18:42 ` [PATCH] media: em28xx: kzalloc + kcalloc to kzalloc_flex Kees Cook
2026-03-20 23:04   ` Rosen Penev

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260320010212.31425-1-rosenp@gmail.com \
    --to=rosenp@gmail.com \
    --cc=gustavoars@kernel.org \
    --cc=kees@kernel.org \
    --cc=linux-hardening@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    --cc=mchehab@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox