On Fri, Mar 06, 2026 at 04:02:57PM +0800, luoqing wrote:
> From: luoqing <[email protected]>
>
> Make use of the struct_size() helper instead of an open-coded version,
> in order to avoid any potential type mistakes or integer overflows that,
> in the worst scenario, could lead to heap overflows.
>
> Signed-off-by: luoqing <[email protected]>
> ---
> drivers/md/dm-bufio.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
> index 60f7badec91f..f8a6b423b4ea 100644
> --- a/drivers/md/dm-bufio.c
> +++ b/drivers/md/dm-bufio.c
> @@ -2511,7 +2511,7 @@ struct dm_bufio_client *dm_bufio_client_create(struct
> block_device *bdev, unsign
> }
>
> num_locks = dm_num_hash_locks();
> - c = kzalloc(sizeof(*c) + (num_locks * sizeof(struct buffer_tree)),
> GFP_KERNEL);
> + c = kzalloc(struct_size(c, buffer_tree, num_locks), GFP_KERNEL);
buffer_tree isn't a member of struct dm_bufio_client (which is the type
of *c). Its a member of struct dm_buffer_cache (which is the type of
c->cache). Since struct_size() uses the same variable for referring to the
base structure and the structure holding the flex array, it won't work
here.
-Ben
> if (!c) {
> r = -ENOMEM;
> goto bad_client;
> --
> 2.25.1
