* [PATCH] drm: dp_tunnel: use kzalloc_flex
@ 2026-03-08 21:12 Rosen Penev
2026-03-10 8:12 ` Ville Syrjälä
0 siblings, 1 reply; 4+ messages in thread
From: Rosen Penev @ 2026-03-08 21:12 UTC (permalink / raw)
To: dri-devel
Cc: Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Kees Cook, Gustavo A. R. Silva, open list,
open list:KERNEL HARDENING (not covered by other areas):Keyword:b__counted_by(_le|_be)?b
Simplifies allocation by using a flexible array member to remove a
second kzalloc.
Added __counted_by for extra runtime analysis.
Simplify assignment loop. It always returns true. That is,
max_group_count is always equal to group_count.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/gpu/drm/display/drm_dp_tunnel.c | 26 ++++++-------------------
1 file changed, 6 insertions(+), 20 deletions(-)
diff --git a/drivers/gpu/drm/display/drm_dp_tunnel.c b/drivers/gpu/drm/display/drm_dp_tunnel.c
index f442430d8de7..aad1605b956e 100644
--- a/drivers/gpu/drm/display/drm_dp_tunnel.c
+++ b/drivers/gpu/drm/display/drm_dp_tunnel.c
@@ -188,13 +188,13 @@ struct drm_dp_tunnel_group {
struct drm_dp_tunnel_mgr {
struct drm_device *dev;
- int group_count;
- struct drm_dp_tunnel_group *groups;
wait_queue_head_t bw_req_queue;
#ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG
struct ref_tracker_dir ref_tracker;
#endif
+ int group_count;
+ struct drm_dp_tunnel_group groups[] __counted_by(group_count);
};
/*
@@ -1893,7 +1893,6 @@ static void destroy_mgr(struct drm_dp_tunnel_mgr *mgr)
ref_tracker_dir_exit(&mgr->ref_tracker);
#endif
- kfree(mgr->groups);
kfree(mgr);
}
@@ -1913,33 +1912,20 @@ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count)
struct drm_dp_tunnel_mgr *mgr;
int i;
- mgr = kzalloc_obj(*mgr);
+ mgr = kzalloc_flex(*mgr, groups, max_group_count);
if (!mgr)
return ERR_PTR(-ENOMEM);
+ mgr->group_count = max_group_count;
mgr->dev = dev;
init_waitqueue_head(&mgr->bw_req_queue);
- mgr->groups = kzalloc_objs(*mgr->groups, max_group_count);
- if (!mgr->groups) {
- kfree(mgr);
-
- return ERR_PTR(-ENOMEM);
- }
-
#ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG
ref_tracker_dir_init(&mgr->ref_tracker, 16, "drm_dptun");
#endif
- for (i = 0; i < max_group_count; i++) {
- if (!init_group(mgr, &mgr->groups[i])) {
- destroy_mgr(mgr);
-
- return ERR_PTR(-ENOMEM);
- }
-
- mgr->group_count++;
- }
+ for (i = 0; i < max_group_count; i++)
+ init_group(mgr, &mgr->groups[i]);
return mgr;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] drm: dp_tunnel: use kzalloc_flex
2026-03-08 21:12 [PATCH] drm: dp_tunnel: use kzalloc_flex Rosen Penev
@ 2026-03-10 8:12 ` Ville Syrjälä
2026-03-10 22:09 ` Rosen Penev
0 siblings, 1 reply; 4+ messages in thread
From: Ville Syrjälä @ 2026-03-10 8:12 UTC (permalink / raw)
To: Rosen Penev
Cc: dri-devel, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann,
David Airlie, Simona Vetter, Kees Cook, Gustavo A. R. Silva,
open list,
open list:KERNEL HARDENING (not covered by other areas):Keyword:b__counted_by(_le|_be)?b
On Sun, Mar 08, 2026 at 02:12:20PM -0700, Rosen Penev wrote:
> Simplifies allocation by using a flexible array member to remove a
> second kzalloc.
>
> Added __counted_by for extra runtime analysis.
>
> Simplify assignment loop. It always returns true. That is,
> max_group_count is always equal to group_count.
>
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
> drivers/gpu/drm/display/drm_dp_tunnel.c | 26 ++++++-------------------
> 1 file changed, 6 insertions(+), 20 deletions(-)
>
> diff --git a/drivers/gpu/drm/display/drm_dp_tunnel.c b/drivers/gpu/drm/display/drm_dp_tunnel.c
> index f442430d8de7..aad1605b956e 100644
> --- a/drivers/gpu/drm/display/drm_dp_tunnel.c
> +++ b/drivers/gpu/drm/display/drm_dp_tunnel.c
> @@ -188,13 +188,13 @@ struct drm_dp_tunnel_group {
> struct drm_dp_tunnel_mgr {
> struct drm_device *dev;
>
> - int group_count;
> - struct drm_dp_tunnel_group *groups;
> wait_queue_head_t bw_req_queue;
>
> #ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG
> struct ref_tracker_dir ref_tracker;
> #endif
> + int group_count;
> + struct drm_dp_tunnel_group groups[] __counted_by(group_count);
> };
>
> /*
> @@ -1893,7 +1893,6 @@ static void destroy_mgr(struct drm_dp_tunnel_mgr *mgr)
> ref_tracker_dir_exit(&mgr->ref_tracker);
> #endif
>
> - kfree(mgr->groups);
> kfree(mgr);
> }
>
> @@ -1913,33 +1912,20 @@ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count)
> struct drm_dp_tunnel_mgr *mgr;
> int i;
>
> - mgr = kzalloc_obj(*mgr);
> + mgr = kzalloc_flex(*mgr, groups, max_group_count);
> if (!mgr)
> return ERR_PTR(-ENOMEM);
>
> + mgr->group_count = max_group_count;
> mgr->dev = dev;
> init_waitqueue_head(&mgr->bw_req_queue);
>
> - mgr->groups = kzalloc_objs(*mgr->groups, max_group_count);
> - if (!mgr->groups) {
> - kfree(mgr);
> -
> - return ERR_PTR(-ENOMEM);
> - }
> -
> #ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG
> ref_tracker_dir_init(&mgr->ref_tracker, 16, "drm_dptun");
> #endif
>
> - for (i = 0; i < max_group_count; i++) {
> - if (!init_group(mgr, &mgr->groups[i])) {
> - destroy_mgr(mgr);
> -
> - return ERR_PTR(-ENOMEM);
> - }
> -
> - mgr->group_count++;
> - }
> + for (i = 0; i < max_group_count; i++)
> + init_group(mgr, &mgr->groups[i]);
This breaks the error handling.
Hmm, actually it looks like it already got broken by commit
8e6da25bd60d ("drm/dp_tunnel: Switch private_obj initialization
to atomic_create_state")...
>
> return mgr;
> }
> --
> 2.53.0
--
Ville Syrjälä
Intel
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] drm: dp_tunnel: use kzalloc_flex
2026-03-10 8:12 ` Ville Syrjälä
@ 2026-03-10 22:09 ` Rosen Penev
2026-03-16 16:44 ` Ville Syrjälä
0 siblings, 1 reply; 4+ messages in thread
From: Rosen Penev @ 2026-03-10 22:09 UTC (permalink / raw)
To: Ville Syrjälä
Cc: dri-devel, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann,
David Airlie, Simona Vetter, Kees Cook, Gustavo A. R. Silva,
open list,
open list:KERNEL HARDENING (not covered by other areas):Keyword:b__counted_by(_le|_be)?b
On Tue, Mar 10, 2026 at 1:12 AM Ville Syrjälä
<ville.syrjala@linux.intel.com> wrote:
>
> On Sun, Mar 08, 2026 at 02:12:20PM -0700, Rosen Penev wrote:
> > Simplifies allocation by using a flexible array member to remove a
> > second kzalloc.
> >
> > Added __counted_by for extra runtime analysis.
> >
> > Simplify assignment loop. It always returns true. That is,
> > max_group_count is always equal to group_count.
> >
> > Signed-off-by: Rosen Penev <rosenp@gmail.com>
> > ---
> > drivers/gpu/drm/display/drm_dp_tunnel.c | 26 ++++++-------------------
> > 1 file changed, 6 insertions(+), 20 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/display/drm_dp_tunnel.c b/drivers/gpu/drm/display/drm_dp_tunnel.c
> > index f442430d8de7..aad1605b956e 100644
> > --- a/drivers/gpu/drm/display/drm_dp_tunnel.c
> > +++ b/drivers/gpu/drm/display/drm_dp_tunnel.c
> > @@ -188,13 +188,13 @@ struct drm_dp_tunnel_group {
> > struct drm_dp_tunnel_mgr {
> > struct drm_device *dev;
> >
> > - int group_count;
> > - struct drm_dp_tunnel_group *groups;
> > wait_queue_head_t bw_req_queue;
> >
> > #ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG
> > struct ref_tracker_dir ref_tracker;
> > #endif
> > + int group_count;
> > + struct drm_dp_tunnel_group groups[] __counted_by(group_count);
> > };
> >
> > /*
> > @@ -1893,7 +1893,6 @@ static void destroy_mgr(struct drm_dp_tunnel_mgr *mgr)
> > ref_tracker_dir_exit(&mgr->ref_tracker);
> > #endif
> >
> > - kfree(mgr->groups);
> > kfree(mgr);
> > }
> >
> > @@ -1913,33 +1912,20 @@ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count)
> > struct drm_dp_tunnel_mgr *mgr;
> > int i;
> >
> > - mgr = kzalloc_obj(*mgr);
> > + mgr = kzalloc_flex(*mgr, groups, max_group_count);
> > if (!mgr)
> > return ERR_PTR(-ENOMEM);
> >
> > + mgr->group_count = max_group_count;
> > mgr->dev = dev;
> > init_waitqueue_head(&mgr->bw_req_queue);
> >
> > - mgr->groups = kzalloc_objs(*mgr->groups, max_group_count);
> > - if (!mgr->groups) {
> > - kfree(mgr);
> > -
> > - return ERR_PTR(-ENOMEM);
> > - }
> > -
> > #ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG
> > ref_tracker_dir_init(&mgr->ref_tracker, 16, "drm_dptun");
> > #endif
> >
> > - for (i = 0; i < max_group_count; i++) {
> > - if (!init_group(mgr, &mgr->groups[i])) {
> > - destroy_mgr(mgr);
> > -
> > - return ERR_PTR(-ENOMEM);
> > - }
> > -
> > - mgr->group_count++;
> > - }
> > + for (i = 0; i < max_group_count; i++)
> > + init_group(mgr, &mgr->groups[i]);
>
> This breaks the error handling.
>
> Hmm, actually it looks like it already got broken by commit
> 8e6da25bd60d ("drm/dp_tunnel: Switch private_obj initialization
> to atomic_create_state")...
I can't comment on that.
This patch does not touch that.
>
> >
> > return mgr;
> > }
> > --
> > 2.53.0
>
> --
> Ville Syrjälä
> Intel
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] drm: dp_tunnel: use kzalloc_flex
2026-03-10 22:09 ` Rosen Penev
@ 2026-03-16 16:44 ` Ville Syrjälä
0 siblings, 0 replies; 4+ messages in thread
From: Ville Syrjälä @ 2026-03-16 16:44 UTC (permalink / raw)
To: Rosen Penev
Cc: dri-devel, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann,
David Airlie, Simona Vetter, Kees Cook, Gustavo A. R. Silva,
open list,
open list:KERNEL HARDENING (not covered by other areas):Keyword:b__counted_by(_le|_be)?b
On Tue, Mar 10, 2026 at 03:09:31PM -0700, Rosen Penev wrote:
> On Tue, Mar 10, 2026 at 1:12 AM Ville Syrjälä
> <ville.syrjala@linux.intel.com> wrote:
> >
> > On Sun, Mar 08, 2026 at 02:12:20PM -0700, Rosen Penev wrote:
> > > Simplifies allocation by using a flexible array member to remove a
> > > second kzalloc.
> > >
> > > Added __counted_by for extra runtime analysis.
> > >
> > > Simplify assignment loop. It always returns true. That is,
> > > max_group_count is always equal to group_count.
> > >
> > > Signed-off-by: Rosen Penev <rosenp@gmail.com>
> > > ---
> > > drivers/gpu/drm/display/drm_dp_tunnel.c | 26 ++++++-------------------
> > > 1 file changed, 6 insertions(+), 20 deletions(-)
> > >
> > > diff --git a/drivers/gpu/drm/display/drm_dp_tunnel.c b/drivers/gpu/drm/display/drm_dp_tunnel.c
> > > index f442430d8de7..aad1605b956e 100644
> > > --- a/drivers/gpu/drm/display/drm_dp_tunnel.c
> > > +++ b/drivers/gpu/drm/display/drm_dp_tunnel.c
> > > @@ -188,13 +188,13 @@ struct drm_dp_tunnel_group {
> > > struct drm_dp_tunnel_mgr {
> > > struct drm_device *dev;
> > >
> > > - int group_count;
> > > - struct drm_dp_tunnel_group *groups;
> > > wait_queue_head_t bw_req_queue;
> > >
> > > #ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG
> > > struct ref_tracker_dir ref_tracker;
> > > #endif
> > > + int group_count;
> > > + struct drm_dp_tunnel_group groups[] __counted_by(group_count);
> > > };
> > >
> > > /*
> > > @@ -1893,7 +1893,6 @@ static void destroy_mgr(struct drm_dp_tunnel_mgr *mgr)
> > > ref_tracker_dir_exit(&mgr->ref_tracker);
> > > #endif
> > >
> > > - kfree(mgr->groups);
> > > kfree(mgr);
> > > }
> > >
> > > @@ -1913,33 +1912,20 @@ drm_dp_tunnel_mgr_create(struct drm_device *dev, int max_group_count)
> > > struct drm_dp_tunnel_mgr *mgr;
> > > int i;
> > >
> > > - mgr = kzalloc_obj(*mgr);
> > > + mgr = kzalloc_flex(*mgr, groups, max_group_count);
> > > if (!mgr)
> > > return ERR_PTR(-ENOMEM);
> > >
> > > + mgr->group_count = max_group_count;
> > > mgr->dev = dev;
> > > init_waitqueue_head(&mgr->bw_req_queue);
> > >
> > > - mgr->groups = kzalloc_objs(*mgr->groups, max_group_count);
> > > - if (!mgr->groups) {
> > > - kfree(mgr);
> > > -
> > > - return ERR_PTR(-ENOMEM);
> > > - }
> > > -
> > > #ifdef CONFIG_DRM_DISPLAY_DP_TUNNEL_STATE_DEBUG
> > > ref_tracker_dir_init(&mgr->ref_tracker, 16, "drm_dptun");
> > > #endif
> > >
> > > - for (i = 0; i < max_group_count; i++) {
> > > - if (!init_group(mgr, &mgr->groups[i])) {
> > > - destroy_mgr(mgr);
> > > -
> > > - return ERR_PTR(-ENOMEM);
> > > - }
> > > -
> > > - mgr->group_count++;
> > > - }
> > > + for (i = 0; i < max_group_count; i++)
> > > + init_group(mgr, &mgr->groups[i]);
> >
> > This breaks the error handling.
> >
> > Hmm, actually it looks like it already got broken by commit
> > 8e6da25bd60d ("drm/dp_tunnel: Switch private_obj initialization
> > to atomic_create_state")...
> I can't comment on that.
>
> This patch does not touch that.
You are removing what remains of the error handling, and that part
would have to be undone to fix the earlier breakage.
Maxime, can you fix that up?
> >
> > >
> > > return mgr;
> > > }
> > > --
> > > 2.53.0
> >
> > --
> > Ville Syrjälä
> > Intel
--
Ville Syrjälä
Intel
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-03-16 16:44 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-08 21:12 [PATCH] drm: dp_tunnel: use kzalloc_flex Rosen Penev
2026-03-10 8:12 ` Ville Syrjälä
2026-03-10 22:09 ` Rosen Penev
2026-03-16 16:44 ` Ville Syrjälä
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox