On 5/31/26 10:39, Takashi Iwai wrote:
>> diff --git a/sound/core/seq_device.c b/sound/core/seq_device.c
>> index 1b062d6b17ea..a7b69ff07261 100644
>> --- a/sound/core/seq_device.c
>> +++ b/sound/core/seq_device.c
>> @@ -234,7 +234,10 @@ int snd_seq_device_new(struct snd_card *card, int device, const char *id,
>>  	if (snd_BUG_ON(!id))
>>  		return -EINVAL;
>>  
>> -	dev = kzalloc(sizeof(*dev) + argsize, GFP_KERNEL);
>> +	if (argsize < 0)
>> +		return -EINVAL;
>> +
>> +	dev = kzalloc(struct_size(dev, args, argsize), GFP_KERNEL);
>>  	if (!dev)
>>  		return -ENOMEM;
> 
> IIRC, we can use kzalloc_flex() for this kind, too:
> 
> 	dev = kzalloc_flex(*dev, args, argsize);

Thanks, I missed kzalloc_flex(). I’ll keep the negative
argsize check in v2, so invalid callers get -EINVAL before
the count is converted to size_t.

-- 
Thanks,
Cássio