> > On 08/03/2017 04:13 PM, Pankaj Gupta wrote: > >> > >> + /* Allocate space for find_vqs parameters */ > >> + vqs = kcalloc(nvqs, sizeof(*vqs), GFP_KERNEL); > >> + if (!vqs) > >> + goto err_vq; > >> + callbacks = kmalloc_array(nvqs, sizeof(*callbacks), GFP_KERNEL); > >> + if (!callbacks) > >> + goto err_callback; > >> + names = kmalloc_array(nvqs, sizeof(*names), GFP_KERNEL); > > > > is size here (integer) intentional? > > > Sorry, I didn't get it. Could you please elaborate more? This is okay > > > > > >> + if (!names) > >> + goto err_names; > >> + > >> + callbacks[0] = balloon_ack; > >> + names[0] = "inflate"; > >> + callbacks[1] = balloon_ack; > >> + names[1] = "deflate"; > >> + > >> + i = 2; > >> + if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_STATS_VQ)) { > >> + callbacks[i] = stats_request; > > just thinking if memory for callbacks[3] & names[3] is allocated? > > > Yes, the above kmalloc_array allocated them. I mean we have created callbacks array for two entries 0,1? callbacks = kmalloc_array(nvqs, sizeof(*callbacks), GFP_KERNEL); But we are trying to access location '2' which is third: i = 2; + if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_STATS_VQ)) { + callbacks[i] = stats_request; <---- callbacks[2] + names[i] = "stats"; <----- names[2] + i++; + } I am missing anything obvious here? > > > Best, > Wei >