From: Kees Cook <kees+treewide@kernel.org>

In preparation for making the devm_kmalloc family of allocators type
aware, we need to make sure that the returned type from the allocation
matches the type of the variable being assigned. (Before, the allocator
would always return "void *", which can be implicitly cast to any
pointer type.)

The assigned type is "struct iio_chan_spec *", but the converted
allocation type would be "const struct iio_chan_spec *", as the size was
taken from "*indio_dev->channels", and "indio_dev->channels" points to
const. As there is no general way to remove const qualifiers, take the
size from the assignment target instead. No change in allocation size
results.

Build tested ARCH=x86_64 allmodconfig with GCC 16.2.0:
drivers/iio/adc/ad7173.o

Assisted-by: LLM coccinelle
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
---
Cc: "Nuno Sá" <nuno.sa@analog.com>
Cc: Michael Hennerich <Michael.Hennerich@analog.com>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: David Lechner <dlechner@baylibre.com>
Cc: Andy Shevchenko <andy@kernel.org>
Cc: <linux@analog.com>
Cc: <linux-iio@vger.kernel.org>
---
 drivers/iio/adc/ad7173.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/adc/ad7173.c b/drivers/iio/adc/ad7173.c
index eb47175a0528..fdd24f3ec1de 100644
--- a/drivers/iio/adc/ad7173.c
+++ b/drivers/iio/adc/ad7173.c
@@ -1801,7 +1801,7 @@ static int ad7173_fw_parse_channel_config(struct iio_dev *indio_dev)
 	indio_dev->num_channels = num_channels;
 	st->num_channels = num_channels;
 
-	chan_arr = devm_kcalloc(dev, sizeof(*indio_dev->channels),
+	chan_arr = devm_kcalloc(dev, sizeof(*chan_arr),
 				st->num_channels, GFP_KERNEL);
 	if (!chan_arr)
 		return -ENOMEM;
-- 
2.34.1

On Thu, 17 Sep 2026 14:14:37 -0700
Kees Cook <kees@kernel.org> wrote:

> From: Kees Cook <kees+treewide@kernel.org>
> 
> In preparation for making the devm_kmalloc family of allocators type
> aware, we need to make sure that the returned type from the allocation
> matches the type of the variable being assigned. (Before, the allocator
> would always return "void *", which can be implicitly cast to any
> pointer type.)
> 
> The assigned type is "struct iio_chan_spec *", but the converted
> allocation type would be "const struct iio_chan_spec *", as the size was
> taken from "*indio_dev->channels", and "indio_dev->channels" points to
> const. As there is no general way to remove const qualifiers, take the
> size from the assignment target instead. No change in allocation size
> results.
> 
> Build tested ARCH=x86_64 allmodconfig with GCC 16.2.0:
> drivers/iio/adc/ad7173.o
> 
> Assisted-by: LLM coccinelle
> Signed-off-by: Kees Cook <kees+treewide@kernel.org>
> ---

Makes sense.

Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>

-- 
Kind regards,
Joshua Crofts

On Thu, Sep 17, 2026 at 02:14:37PM -0700, Kees Cook wrote:

> In preparation for making the devm_kmalloc family of allocators type
> aware, we need to make sure that the returned type from the allocation
> matches the type of the variable being assigned. (Before, the allocator
> would always return "void *", which can be implicitly cast to any
> pointer type.)
> 
> The assigned type is "struct iio_chan_spec *", but the converted
> allocation type would be "const struct iio_chan_spec *", as the size was
> taken from "*indio_dev->channels", and "indio_dev->channels" points to
> const. As there is no general way to remove const qualifiers, take the
> size from the assignment target instead. No change in allocation size
> results.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

...

> -	chan_arr = devm_kcalloc(dev, sizeof(*indio_dev->channels),
> +	chan_arr = devm_kcalloc(dev, sizeof(*chan_arr),
>  				st->num_channels, GFP_KERNEL);

I would even dare to put it on a single line now (yes, 86 characters long).
(No need to resend, Jonathan I hope can tweak if he agrees with this.)

-- 
With Best Regards,
Andy Shevchenko

On Fri, 18 Sep 2026 09:51:48 +0300
Andy Shevchenko <andriy.shevchenko@intel.com> wrote:

> On Thu, Sep 17, 2026 at 02:14:37PM -0700, Kees Cook wrote:
> 
> > In preparation for making the devm_kmalloc family of allocators type
> > aware, we need to make sure that the returned type from the allocation
> > matches the type of the variable being assigned. (Before, the allocator
> > would always return "void *", which can be implicitly cast to any
> > pointer type.)
> > 
> > The assigned type is "struct iio_chan_spec *", but the converted
> > allocation type would be "const struct iio_chan_spec *", as the size was
> > taken from "*indio_dev->channels", and "indio_dev->channels" points to
> > const. As there is no general way to remove const qualifiers, take the
> > size from the assignment target instead. No change in allocation size
> > results.  
> 
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
> 
> ...
> 
> > -	chan_arr = devm_kcalloc(dev, sizeof(*indio_dev->channels),
> > +	chan_arr = devm_kcalloc(dev, sizeof(*chan_arr),
> >  				st->num_channels, GFP_KERNEL);  
> 
> I would even dare to put it on a single line now (yes, 86 characters long).
> (No need to resend, Jonathan I hope can tweak if he agrees with this.)
Done, though I would assume Kees is going to send a mega series
that rewrites this line anyway and might well make it even shorter.

Applied to the testing branch of iio.git (queued for next merge window
subject to tests etc)

Thanks,

Jonathan

>

On Mon, Sep 21, 2026 at 12:21:28AM +0100, Jonathan Cameron wrote:
> On Fri, 18 Sep 2026 09:51:48 +0300
> Andy Shevchenko <andriy.shevchenko@intel.com> wrote:
> 
> > On Thu, Sep 17, 2026 at 02:14:37PM -0700, Kees Cook wrote:
> > 
> > > In preparation for making the devm_kmalloc family of allocators type
> > > aware, we need to make sure that the returned type from the allocation
> > > matches the type of the variable being assigned. (Before, the allocator
> > > would always return "void *", which can be implicitly cast to any
> > > pointer type.)
> > > 
> > > The assigned type is "struct iio_chan_spec *", but the converted
> > > allocation type would be "const struct iio_chan_spec *", as the size was
> > > taken from "*indio_dev->channels", and "indio_dev->channels" points to
> > > const. As there is no general way to remove const qualifiers, take the
> > > size from the assignment target instead. No change in allocation size
> > > results.  
> > 
> > Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
> > 
> > ...
> > 
> > > -	chan_arr = devm_kcalloc(dev, sizeof(*indio_dev->channels),
> > > +	chan_arr = devm_kcalloc(dev, sizeof(*chan_arr),
> > >  				st->num_channels, GFP_KERNEL);  
> > 
> > I would even dare to put it on a single line now (yes, 86 characters long).
> > (No need to resend, Jonathan I hope can tweak if he agrees with this.)
> Done, though I would assume Kees is going to send a mega series
> that rewrites this line anyway and might well make it even shorter.

I will indeed. :) But Coccinelle will be happy with whatever shape it
has. (It'll swap "devm_kcalloc" for "devm_kmalloc" and then gain "_objs"
and lose ", GFP_KERNEL".)

> Applied to the testing branch of iio.git (queued for next merge window
> subject to tests etc)

Thanks!

-- 
Kees Cook