Since commit c35fac6481a1d ("mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion"), mmc_test_alloc_mem() bounds its fill loop with mem->cnt, relying on kzalloc_flex() to have set it to "max_segs". kzalloc_flex() only sets the __counted_by() counter when the compiler supports __builtin_counted_by_ref(). Otherwise mem->cnt is still zero after the first segment is stored. Set mem->cnt after the allocation, as that commit's description intends. Build tested ARCH=x86_64 defconfig with CONFIG_MMC_TEST=m and W=1, with GCC 16.2.0. Fixes: c35fac6481a1d ("mmc: mmc_test: Fix __counted_by handling after kzalloc_flex() conversion") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook --- drivers/mmc/core/mmc_test.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c index 4dc16649e61d..aa30df9d33d8 100644 --- a/drivers/mmc/core/mmc_test.c +++ b/drivers/mmc/core/mmc_test.c @@ -357,6 +357,7 @@ static struct mmc_test_mem *mmc_test_alloc_mem(unsigned long min_sz, mem = kzalloc_flex(*mem, arr, max_segs); if (!mem) return NULL; + mem->cnt = max_segs; while (max_page_cnt) { struct page *page; -- 2.55.0