I will drop this patch, because I have a doubt: Suppose the nd_region->ndr_mappings is 4, and for each nd_region->mapping[], the value of num_flush is "0, 0, 4, 0", so the flush_data_size is "1 + 1 + 5 + 1", * sizeof(void *). But in ndrd_get_flush_wpq() or ndrd_set_flush_wpq(), the expression is "ndrd->flush_wpq[dimm * num + (hint & mask)]", I don't think the memory "ndrd" allocated is enough. Please refer call chain: nd_region_activate() --> nvdimm_map_flush() --> ndrd_set_flush_wpq()
for (i = 0; i < nd_region->ndr_mappings; i++) { struct nd_mapping *nd_mapping = &nd_region->mapping[i]; struct nvdimm *nvdimm = nd_mapping->nvdimm; /* at least one null hint slot per-dimm for the "no-hint" case */ flush_data_size += sizeof(void *); num_flush = min_not_zero(num_flush, nvdimm->num_flush); if (!nvdimm->num_flush) continue; flush_data_size += nvdimm->num_flush * sizeof(void *); } ndrd = devm_kzalloc(dev, sizeof(*ndrd) + flush_data_size, GFP_KERNEL); On 2020/8/20 10:16, Zhen Lei wrote: > According to the original code logic: > if (!nvdimm->num_flush) { > flush_data_size += sizeof(void *); > //nvdimm->num_flush is zero now, add 1) have no side effects > } else { > flush_data_size += sizeof(void *); > 1) flush_data_size += nvdimm->num_flush * sizeof(void *); > } > > Obviously, the above code snippet can be reduced to one statement: > flush_data_size += (nvdimm->num_flush + 1) * sizeof(void *); > > No functional change. > > Signed-off-by: Zhen Lei <thunder.leiz...@huawei.com> > --- > drivers/nvdimm/region_devs.c | 5 +---- > 1 file changed, 1 insertion(+), 4 deletions(-) > > diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c > index 7cf9c7d857909ce..49be115c9189eff 100644 > --- a/drivers/nvdimm/region_devs.c > +++ b/drivers/nvdimm/region_devs.c > @@ -77,11 +77,8 @@ int nd_region_activate(struct nd_region *nd_region) > } > > /* at least one null hint slot per-dimm for the "no-hint" case > */ > - flush_data_size += sizeof(void *); > + flush_data_size += (nvdimm->num_flush + 1) * sizeof(void *); > num_flush = min_not_zero(num_flush, nvdimm->num_flush); > - if (!nvdimm->num_flush) > - continue; > - flush_data_size += nvdimm->num_flush * sizeof(void *); > } > nvdimm_bus_unlock(&nd_region->dev); > >