[PATCH] mmc: mmc_test: Set "cnt" to the allocated size explicitly

[PATCH] mmc: mmc_test: Set "cnt" to the allocated size explicitly

[Kees Cook]

Since commit c35fac6481a1d ("mmc: mmc_test: Fix __counted_by handling
after kzalloc_flex() conversion"), mmc_test_alloc_mem() bounds its fill
loop with mem->cnt, relying on kzalloc_flex() to have set it to
"max_segs". kzalloc_flex() only sets the __counted_by() counter when the
compiler supports __builtin_counted_by_ref(). Otherwise mem->cnt is still
zero after the first segment is stored.

Set mem->cnt after the allocation, as that commit's description intends.

Build tested ARCH=x86_64 defconfig with CONFIG_MMC_TEST=m and W=1, with
GCC 16.2.0.

Fixes: c35fac6481a1d ("mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
---
 drivers/mmc/core/mmc_test.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c
index 4dc16649e61d..aa30df9d33d8 100644
--- a/drivers/mmc/core/mmc_test.c
+++ b/drivers/mmc/core/mmc_test.c
@@ -357,6 +357,7 @@ static struct mmc_test_mem *mmc_test_alloc_mem(unsigned long min_sz,
 	mem = kzalloc_flex(*mem, arr, max_segs);
 	if (!mem)
 		return NULL;
+	mem->cnt = max_segs;
 
 	while (max_page_cnt) {
 		struct page *page;
-- 
2.55.0