Embed the RX reorder pointer array in struct mwifiex_rx_reorder_tbl
instead of allocating it separately.

This ties the array to the reorder table lifetime and removes a separate
allocation and cleanup path.

Use kzalloc_flex() for this and move the counting variable assignment to
after it as it does for GCC >= 15 already.

Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 .../wireless/marvell/mwifiex/11n_rxreorder.c  | 20 +++----------------
 drivers/net/wireless/marvell/mwifiex/main.h   |  2 +-
 2 files changed, 4 insertions(+), 18 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index 610ec8302adf..a266f09cb763 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -213,7 +213,6 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
 	list_del(&tbl->list);
 	spin_unlock_bh(&priv->rx_reorder_tbl_lock);

-	kfree(tbl->rx_reorder_ptr);
 	kfree(tbl);

 	spin_lock_bh(&priv->adapter->rx_proc_lock);
@@ -329,7 +328,6 @@ static void
 mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 				  int tid, int win_size, int seq_num)
 {
-	int i;
 	struct mwifiex_rx_reorder_tbl *tbl, *new_node;
 	u16 last_seq = 0;
 	struct mwifiex_sta_node *node;
@@ -344,10 +342,12 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 		return;
 	}
 	/* if !tbl then create one */
-	new_node = kzalloc_obj(struct mwifiex_rx_reorder_tbl);
+	new_node = kzalloc_flex(*new_node, rx_reorder_ptr, win_size);
 	if (!new_node)
 		return;

+	new_node->win_size = win_size;
+
 	INIT_LIST_HEAD(&new_node->list);
 	new_node->tid = tid;
 	memcpy(new_node->ta, ta, ETH_ALEN);
@@ -381,26 +381,12 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 		new_node->flags |= RXREOR_INIT_WINDOW_SHIFT;
 	}

-	new_node->win_size = win_size;
-
-	new_node->rx_reorder_ptr = kcalloc(win_size, sizeof(void *),
-					   GFP_KERNEL);
-	if (!new_node->rx_reorder_ptr) {
-		kfree(new_node);
-		mwifiex_dbg(priv->adapter, ERROR,
-			    "%s: failed to alloc reorder_ptr\n", __func__);
-		return;
-	}
-
 	new_node->timer_context.ptr = new_node;
 	new_node->timer_context.priv = priv;
 	new_node->timer_context.timer_is_set = false;

 	timer_setup(&new_node->timer_context.timer, mwifiex_flush_data, 0);

-	for (i = 0; i < win_size; ++i)
-		new_node->rx_reorder_ptr[i] = NULL;
-
 	spin_lock_bh(&priv->rx_reorder_tbl_lock);
 	list_add_tail(&new_node->list, &priv->rx_reorder_tbl_ptr);
 	spin_unlock_bh(&priv->rx_reorder_tbl_lock);
diff --git a/drivers/net/wireless/marvell/mwifiex/main.h b/drivers/net/wireless/marvell/mwifiex/main.h
index 27559e2ddc31..67da5daa48b4 100644
--- a/drivers/net/wireless/marvell/mwifiex/main.h
+++ b/drivers/net/wireless/marvell/mwifiex/main.h
@@ -708,10 +708,10 @@ struct mwifiex_rx_reorder_tbl {
 	int init_win;
 	int start_win;
 	int win_size;
-	void **rx_reorder_ptr;
 	struct reorder_tmr_cnxt timer_context;
 	u8 amsdu;
 	u8 flags;
+	void *rx_reorder_ptr[] __counted_by(win_size);
 };

 struct mwifiex_bss_prio_node {
--
2.54.0

Hi Rosen,

On Mon, 2026-05-18 at 14:18 -0700, Rosen Penev wrote:
> Embed the RX reorder pointer array in struct mwifiex_rx_reorder_tbl
> instead of allocating it separately.

Others might disagree, but personally, I think you should stop doing
this. Sure, it *might* (I've been bitten too much by __counted_by) be a
border-line improvement, but it's not _really_ all that useful,
especially on these older drivers.

Did you even test it at all?

And then especially

> Assisted-by: Codex:GPT-5.5

if you do it this way, you're going to be able to produce such changes
with way less effort than anyone can possibly review. And since for all
of the fringe drivers the review falls on me personally, well, I'm just
not going to keep up.

If you _really_ want to help, please help review changes rather than
producing more noise. Maybe even take over maintenance of some specific
driver that you can test.

johannes