From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C1D592248AF for ; Mon, 11 May 2026 04:19:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778473194; cv=none; b=de7OhjB+iNsab+jvYvMLMH6MRuhMxw4uiXeXfM3Gt6WMe4w4MWTT0qzAHp49zpRkPeGQ8j4QtGDLFOAKXIOmVxv4k7o3354IMHtJ2jLBmmMJ+zOXWDUkVT9cv/hILdXMaeY9UjnJTn5mUjNEE7oV9rHeHfgG5dN8/fCAdnoZYbM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778473194; c=relaxed/simple; bh=l9r0k9O845xmFH49LN0SvAE9g5m1PdtjkXkKvP0Tdwg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Rj5XOzgDdvHD1mNHkk5SPklcIvLavtDGSmuKX9VuvDEa5vJ78S4SaQFMQnIYZ3yAToqy01/lZPQqs3NFgBlY5fRGjYzPSPxZoZTg86UrFBDm+CGoxaHgono5QdzxldKCD/qOCEoEvzHlxnuFO2Mta1cnT2ZN/+N8li2J8+kFAkU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Bq6pa+pM; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Bq6pa+pM" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-83975e992e1so1813833b3a.2 for ; Sun, 10 May 2026 21:19:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778473192; x=1779077992; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=yuGDf9iNAynlSPvBXud+v9E3yiQ53OcQ/UBsB/xF9OA=; b=Bq6pa+pMaeQ6MDDQkvze95i95EGTsiP1FgnEWMej1kItue/bfaDEUpGc4+pgho/TJZ tIaoDcyXUiLccLncam/3JFKkZLduyqZP6Cd1EQidcHa8XV1I25VWOW+z5h8cLwVTVA3p 5wqw9lwm4X6FcwOze0ybtdu+W4U7wuG9sheFdHxIpvask/0nzin7N6zrNZUjrbidTGel Auri7mvp87Vm7dDUA4y7jUi1lpdN4sg2P79hI2pU/AGspQh6oFKCHNa7kdTVLmz8lGaH 0Vm2Js5d0ZVCDzSOBsEs+aLjM0X369HN1LZ3bj/Jq0TIS8m3CNAc+j9suMg7v+1Y+JdK GEzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778473192; x=1779077992; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=yuGDf9iNAynlSPvBXud+v9E3yiQ53OcQ/UBsB/xF9OA=; b=D132F3r2kD6dR5MFpRcvAm1flwm5V4MtMkgAzaASNVVpJ7bke3EzeYShlawQPtDQDE nbIodBBkEVrjBHAp8uAbZn1Uh+2EKk9lP8QBAhDI3m9SN0su2VxdPczNqtwD741LUvUG uR+C9IgrepVLK0tvTJGSopKPIBppt1DBIn6VZOtpF2S+0MgjG8n8GghnHu9viVzVW38V 7MSIq3y//wbfQCkCjpJ4BEMqG/uYIMo0q1nwNzSCOLzaJzfRoD0dbJ5nMbO66v2Kqwdy SPEPHzGuYv1jqJsP1VKZt5Sn4ta+aDLD6HDjibbJhOBpCAV96Sz50XHS1KW+GDpf8PVl qrFg== X-Forwarded-Encrypted: i=1; AFNElJ93gUPMZLf4YHy5kGrYC6Sj6QtYufT85MVedHx2A3CPX2Q3Y5cGAmZoLRc2vUemYIj1Pw/hx6Af2mwCN64=@vger.kernel.org X-Gm-Message-State: AOJu0YwaCD3XX4kOSXS7WC9sfhNEF2UCYeml5VrDSbt+2/Wb+k0W5ZLP h/kBzo7Gso/NyvVzqnD+OHiDui+kubRuHjLEGNecCoOTGnfYVaeKfUm2 X-Gm-Gg: Acq92OEOkqi6zkUxarCkhNLhjtzrRlXOHdI6FJCJgNtd5KpLOa1Puq6L5/uNVEG3tFd s+p2vuhrImi0A6aNwekStcrYQpO2jjV/mAaYavNGCHN9HKe6PA82BtuOrWjJp729j747+QtB1Ym 8mk/OmyA78MxSy67M2ipGCFEMeweHpbOaIVWjp8uG80pvtv4tCscbtRHsvWXduGpRZ2416Zibam e58iHnl4+u+UFwkgmUaL/LB/4yQH0QEzxlWdmsH/EJGJJy56TVKquldzk6UxSKasBt9p5V4KYyo BdnvSbeMA6vsqwj1NC4P2TKoo9Gax0Uax3RG2LJj/MG93XzgvktTltKlBU4VbdeRLn4kzXrV3yW wFS6VysSIG4EsG5pXCI/DhFiZGdKQRWqOA0TuzaM/0HeRxapCb1lNm/yf3UoWPAK2WjRGwz9JUN CwPYFeACh4AsbxgsYkSFsXOYhspwQHZkGfvsTYBo5gA8ICqxkM23WXcJgCOLXO9caekwu9XFunz VQF7+wh1fXPMs+bhxQscy3VCILfrBRuExb8OjgKtVd/ZA== X-Received: by 2002:a05:6a00:2e90:b0:831:7f71:c810 with SMTP id d2e1a72fcca58-83a5d96fa9dmr22809905b3a.35.1778473192058; Sun, 10 May 2026 21:19:52 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-839659498f1sm23736106b3a.17.2026.05.10.21.19.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 10 May 2026 21:19:51 -0700 (PDT) From: Rosen Penev To: linux-wireless@vger.kernel.org Cc: Kees Cook , "Gustavo A. R. Silva" , b43-dev@lists.infradead.org (open list:B43LEGACY WIRELESS DRIVER), linux-kernel@vger.kernel.org (open list), linux-hardening@vger.kernel.org (open list:KERNEL HARDENING (not covered by other areas):Keyword:\b__counted_by(_le|_be)?\b) Subject: [PATCH wireless-next] wifi: b43legacy: Use flexible array for DMA metadata Date: Sun, 10 May 2026 21:19:34 -0700 Message-ID: <20260511041934.378209-1-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Store the per-descriptor metadata in the DMA ring allocation instead of allocating it separately. This ties the metadata lifetime directly to the ring, removes a separate allocation failure path, and keeps the descriptor count available for __counted_by() bounds checking. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev --- drivers/net/wireless/broadcom/b43legacy/dma.c | 24 ++++++++----------- drivers/net/wireless/broadcom/b43legacy/dma.h | 4 ++-- 2 files changed, 12 insertions(+), 16 deletions(-) diff --git a/drivers/net/wireless/broadcom/b43legacy/dma.c b/drivers/net/wireless/broadcom/b43legacy/dma.c index a9557356c9ab..6c3d847242bb 100644 --- a/drivers/net/wireless/broadcom/b43legacy/dma.c +++ b/drivers/net/wireless/broadcom/b43legacy/dma.c @@ -610,25 +610,25 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, int nr_slots; dma_addr_t dma_test; - ring = kzalloc_obj(*ring); + if (for_tx) + nr_slots = B43legacy_TXRING_SLOTS; + else + nr_slots = B43legacy_RXRING_SLOTS; + + ring = kzalloc_flex(*ring, meta, nr_slots); if (!ring) goto out; + + ring->nr_slots = nr_slots; ring->type = type; ring->dev = dev; - nr_slots = B43legacy_RXRING_SLOTS; - if (for_tx) - nr_slots = B43legacy_TXRING_SLOTS; - - ring->meta = kzalloc_objs(struct b43legacy_dmadesc_meta, nr_slots); - if (!ring->meta) - goto err_kfree_ring; if (for_tx) { ring->txhdr_cache = kcalloc(nr_slots, sizeof(struct b43legacy_txhdr_fw3), GFP_KERNEL); if (!ring->txhdr_cache) - goto err_kfree_meta; + goto err_kfree_ring; /* test for ability to dma to txhdr_cache */ dma_test = dma_map_single(dev->dev->dma_dev, ring->txhdr_cache, @@ -643,7 +643,7 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, sizeof(struct b43legacy_txhdr_fw3), GFP_KERNEL | GFP_DMA); if (!ring->txhdr_cache) - goto err_kfree_meta; + goto err_kfree_txhdr_cache; dma_test = dma_map_single(dev->dev->dma_dev, ring->txhdr_cache, @@ -660,7 +660,6 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, DMA_TO_DEVICE); } - ring->nr_slots = nr_slots; ring->mmio_base = b43legacy_dmacontroller_base(type, controller_index); ring->index = controller_index; if (for_tx) { @@ -694,8 +693,6 @@ struct b43legacy_dmaring *b43legacy_setup_dmaring(struct b43legacy_wldev *dev, free_ringmemory(ring); err_kfree_txhdr_cache: kfree(ring->txhdr_cache); -err_kfree_meta: - kfree(ring->meta); err_kfree_ring: kfree(ring); ring = NULL; @@ -720,7 +717,6 @@ static void b43legacy_destroy_dmaring(struct b43legacy_dmaring *ring) free_ringmemory(ring); kfree(ring->txhdr_cache); - kfree(ring->meta); kfree(ring); } diff --git a/drivers/net/wireless/broadcom/b43legacy/dma.h b/drivers/net/wireless/broadcom/b43legacy/dma.h index b5c1a51db2a4..edd06225b64f 100644 --- a/drivers/net/wireless/broadcom/b43legacy/dma.h +++ b/drivers/net/wireless/broadcom/b43legacy/dma.h @@ -122,8 +122,6 @@ enum b43legacy_dmatype { struct b43legacy_dmaring { /* Kernel virtual base address of the ring memory. */ void *descbase; - /* Meta data about all descriptors. */ - struct b43legacy_dmadesc_meta *meta; /* Cache of TX headers for each slot. * This is to avoid an allocation on each TX. * This is NULL for an RX ring. @@ -161,6 +159,8 @@ struct b43legacy_dmaring { /* Last time we injected a ring overflow. */ unsigned long last_injected_overflow; #endif /* CONFIG_B43LEGACY_DEBUG*/ + /* Meta data about all descriptors. */ + struct b43legacy_dmadesc_meta meta[] __counted_by(nr_slots); }; -- 2.54.0