Re: [PATCH 2/2] dm-bufio: Use struct_size() helper in kmalloc()

[Benjamin Marzinski <bmarzins@redhat.com>]

On Fri, Mar 06, 2026 at 04:02:57PM +0800, luoqing wrote:
> From: luoqing <luoqing@kylinos.cn>
> 
> Make use of the struct_size() helper instead of an open-coded version,
> in order to avoid any potential type mistakes or integer overflows that,
> in the worst scenario, could lead to heap overflows.
> 
> Signed-off-by: luoqing <luoqing@kylinos.cn>
> ---
>  drivers/md/dm-bufio.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
> index 60f7badec91f..f8a6b423b4ea 100644
> --- a/drivers/md/dm-bufio.c
> +++ b/drivers/md/dm-bufio.c
> @@ -2511,7 +2511,7 @@ struct dm_bufio_client *dm_bufio_client_create(struct block_device *bdev, unsign
>  	}
>  
>  	num_locks = dm_num_hash_locks();
> -	c = kzalloc(sizeof(*c) + (num_locks * sizeof(struct buffer_tree)), GFP_KERNEL);
> +	c = kzalloc(struct_size(c, buffer_tree, num_locks), GFP_KERNEL);

buffer_tree isn't a member of struct dm_bufio_client (which is the type
of *c). Its a member of struct dm_buffer_cache (which is the type of
c->cache). Since struct_size() uses the same variable for referring to the
base structure and the structure holding the flex array, it won't work
here.

-Ben

>  	if (!c) {
>  		r = -ENOMEM;
>  		goto bad_client;
> -- 
> 2.25.1