unsigned long   len;
        struct se_cmd   *cmd;
        struct kiocb    iocb;
+       struct bio_vec  bvecs[];
 };
 
 static void cmd_rw_aio_complete(struct kiocb *iocb, long ret, long ret2)
        struct target_core_file_cmd *aio_cmd;
        struct iov_iter iter = {};
        struct scatterlist *sg;
-       struct bio_vec *bvec;
        ssize_t len = 0;
        int ret = 0, i;
 
-       aio_cmd = kmalloc(sizeof(struct target_core_file_cmd), GFP_KERNEL);
+       aio_cmd = kmalloc(struct_size(aio_cmd, bvecs, sgl_nents), GFP_KERNEL);
        if (!aio_cmd)
                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
 
-       bvec = kcalloc(sgl_nents, sizeof(struct bio_vec), GFP_KERNEL);
-       if (!bvec) {
-               kfree(aio_cmd);
-               return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-       }
-
        for_each_sg(sgl, sg, sgl_nents, i) {
-               bvec[i].bv_page = sg_page(sg);
-               bvec[i].bv_len = sg->length;
-               bvec[i].bv_offset = sg->offset;
+               aio_cmd->bvecs[i].bv_page = sg_page(sg);
+               aio_cmd->bvecs[i].bv_len = sg->length;
+               aio_cmd->bvecs[i].bv_offset = sg->offset;
 
                len += sg->length;
        }
 
-       iov_iter_bvec(&iter, is_write, bvec, sgl_nents, len);
+       iov_iter_bvec(&iter, is_write, aio_cmd->bvecs, sgl_nents, len);
 
        aio_cmd->cmd = cmd;
        aio_cmd->len = len;
        else
                ret = call_read_iter(file, &aio_cmd->iocb, &iter);
 
-       kfree(bvec);
-
        if (ret != -EIOCBQUEUED)
                cmd_rw_aio_complete(&aio_cmd->iocb, ret, 0);