Re: [PATCHv3] thunderbolt: use kzalloc_flex

[Kees Cook]

On Wed, Mar 18, 2026 at 11:52:37AM -0700, Rosen Penev wrote:
> Simplifies allocation by using a flexible arraay member.
> 
> Added __counted_by for extra runtime analysis.
> 
> Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>

I don't see struct tb_path composed anywhere else; looks good to me.

Reviewed-by: Kees Cook <kees@xxxxxxxxxx>

-Kees

> ---
>  v3: fix kdoc
>  v2: remove extra kfree to fix kernel test bot.
>  drivers/thunderbolt/path.c | 28 +++++++---------------------
>  drivers/thunderbolt/tb.h   |  5 +++--
>  2 files changed, 10 insertions(+), 23 deletions(-)
> 
> diff --git a/drivers/thunderbolt/path.c b/drivers/thunderbolt/path.c
> index 22fb4a1e1acd..8713ea0f47c1 100644
> --- a/drivers/thunderbolt/path.c
> +++ b/drivers/thunderbolt/path.c
> @@ -150,22 +150,17 @@ struct tb_path *tb_path_discover(struct tb_port *src, int src_hopid,
>  		num_hops++;
>  	}
> 
> -	path = kzalloc_obj(*path);
> +	path = kzalloc_flex(*path, hops, num_hops);
>  	if (!path)
>  		return NULL;
> 
> +	path->path_length = num_hops;
> +
>  	path->name = name;
>  	path->tb = src->sw->tb;
> -	path->path_length = num_hops;
>  	path->activated = true;
>  	path->alloc_hopid = alloc_hopid;
> 
> -	path->hops = kzalloc_objs(*path->hops, num_hops);
> -	if (!path->hops) {
> -		kfree(path);
> -		return NULL;
> -	}
> -
>  	tb_dbg(path->tb, "discovering %s path starting from %llx:%u\n",
>  	       path->name, tb_route(src->sw), src->port);
> 
> @@ -245,10 +240,6 @@ struct tb_path *tb_path_alloc(struct tb *tb, struct tb_port *src, int src_hopid,
>  	size_t num_hops;
>  	int i, ret;
> 
> -	path = kzalloc_obj(*path);
> -	if (!path)
> -		return NULL;
> -
>  	first_port = last_port = NULL;
>  	i = 0;
>  	tb_for_each_port_on_path(src, dst, in_port) {
> @@ -259,20 +250,17 @@ struct tb_path *tb_path_alloc(struct tb *tb, struct tb_port *src, int src_hopid,
>  	}
> 
>  	/* Check that src and dst are reachable */
> -	if (first_port != src || last_port != dst) {
> -		kfree(path);
> +	if (first_port != src || last_port != dst)
>  		return NULL;
> -	}
> 
>  	/* Each hop takes two ports */
>  	num_hops = i / 2;
> 
> -	path->hops = kzalloc_objs(*path->hops, num_hops);
> -	if (!path->hops) {
> -		kfree(path);
> +	path = kzalloc_flex(*path, hops, num_hops);
> +	if (!path)
>  		return NULL;
> -	}
> 
> +	path->path_length = num_hops;
>  	path->alloc_hopid = true;
> 
>  	in_hopid = src_hopid;
> @@ -339,7 +327,6 @@ struct tb_path *tb_path_alloc(struct tb *tb, struct tb_port *src, int src_hopid,
>  	}
> 
>  	path->tb = tb;
> -	path->path_length = num_hops;
>  	path->name = name;
> 
>  	return path;
> @@ -372,7 +359,6 @@ void tb_path_free(struct tb_path *path)
>  		}
>  	}
> 
> -	kfree(path->hops);
>  	kfree(path);
>  }
> 
> diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h
> index e96474f17067..217c3114bec8 100644
> --- a/drivers/thunderbolt/tb.h
> +++ b/drivers/thunderbolt/tb.h
> @@ -419,9 +419,9 @@ enum tb_path_port {
>   * @activated: Is the path active
>   * @clear_fc: Clear all flow control from the path config space entries
>   *	      when deactivating this path
> - * @hops: Path hops
>   * @path_length: How many hops the path uses
>   * @alloc_hopid: Does this path consume port HopID
> + * @hops: Path hops
>   *
>   * A path consists of a number of hops (see &struct tb_path_hop). To
>   * establish a PCIe tunnel two paths have to be created between the two
> @@ -440,9 +440,10 @@ struct tb_path {
>  	bool drop_packages;
>  	bool activated;
>  	bool clear_fc;
> -	struct tb_path_hop *hops;
>  	int path_length;
>  	bool alloc_hopid;
> +
> +	struct tb_path_hop hops[] __counted_by(path_length);
>  };
> 
>  /* HopIDs 0-7 are reserved by the Thunderbolt protocol */
> --
> 2.53.0
> 

-- 
Kees Cook