Batch 1: Annotate structs with __counted_by

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct fib_info.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc "David S. Miller" <[email protected]>

Cc David Ahern <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  include/net/ip_fib.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

include/net/ip_fib.h +1 -1

index f0c13864180e..84b0a82c9df4 100644
@@ -156,7 +156,7 @@ struct fib_info {
  	bool			nh_updated;
  	struct nexthop		*nh;
  	struct rcu_head		rcu;
-	struct fib_nh		fib_nh[];
+	struct fib_nh		fib_nh[] __counted_by(fib_nhs);
  };
 
 

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct ip_sf_socklist.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc "David S. Miller" <[email protected]>

Cc Martin KaFai Lau <[email protected]>

Cc "Gustavo A. R. Silva" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Alexei Starovoitov <[email protected]>

Cc Jakub Kicinski <[email protected]>

Signed-off-by Kees Cook <[email protected]>

---
  include/linux/igmp.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

include/linux/igmp.h +1 -1

index ebf4349a53af..5171231f70a8 100644
@@ -39,7 +39,7 @@ struct ip_sf_socklist {
  	unsigned int		sl_max;
  	unsigned int		sl_count;
  	struct rcu_head		rcu;
-	__be32			sl_addr[];
+	__be32			sl_addr[] __counted_by(sl_max);
  };
 
  #define IP_SFBLOCK	10	/* allocate this many at once */

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct ip6_sf_socklist.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  include/net/if_inet6.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

include/net/if_inet6.h +1 -1

index c8490729b4ae..3e454c4d7ba6 100644
@@ -89,7 +89,7 @@ struct ip6_sf_socklist {
  	unsigned int		sl_max;
  	unsigned int		sl_count;
  	struct rcu_head		rcu;
-	struct in6_addr		sl_addr[];
+	struct in6_addr		sl_addr[] __counted_by(sl_max);
  };
 
  #define IP6_SFBLOCK	10	/* allocate this many at once */

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct ppe_common_cb.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Yisen Zhuang <[email protected]>

Cc Salil Mehta <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.h +1 -1

index 0f0e16f9afc0..7e00231c1acf 100644
@@ -92,7 +92,7 @@ struct ppe_common_cb {
  	u8 comm_index;   /*ppe_common index*/
 
  	u32 ppe_num;
-	struct hns_ppe_cb ppe_cb[];
+	struct hns_ppe_cb ppe_cb[] __counted_by(ppe_num);
 
  };
 

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct enetc_int_vector.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Claudiu Manoil <[email protected]>

Cc Vladimir Oltean <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  drivers/net/ethernet/freescale/enetc/enetc.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ethernet/freescale/enetc/enetc.h +1 -1

index 7439739cd81a..a9c2ff22431c 100644
@@ -297,7 +297,7 @@ struct enetc_int_vector {
  	char name[ENETC_INT_NAME_MAX];
 
  	struct enetc_bdr rx_ring;
-	struct enetc_bdr tx_ring[];
+	struct enetc_bdr tx_ring[] __counted_by(count_tx_rings);
  } ____cacheline_aligned_in_smp;
 
  struct enetc_cls_rule {

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct rcb_common_cb.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Yisen Zhuang <[email protected]>

Cc Salil Mehta <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h +1 -1

index a9f805925699..c1e9b6997853 100644
@@ -108,7 +108,7 @@ struct rcb_common_cb {
  	u32 ring_num;
  	u32 desc_num; /*  desc num per queue*/
 
-	struct ring_pair_cb ring_pair_cb[];
+	struct ring_pair_cb ring_pair_cb[] __counted_by(ring_num);
  };
 
  int hns_rcb_buf_size2type(u32 buf_size);

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct mana_rxq.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc "K. Y. Srinivasan" <[email protected]>

Cc Haiyang Zhang <[email protected]>

Cc Wei Liu <[email protected]>

Cc Dexuan Cui <[email protected]>

Cc Long Li <[email protected]>

Cc Ajay Sharma <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Cc [email protected]

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  include/net/mana/mana.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

include/net/mana/mana.h +1 -1

index 9f70b4332238..38441be68592 100644
@@ -338,7 +338,7 @@ struct mana_rxq {
  	/* MUST BE THE LAST MEMBER:
  	 * Each receive buffer has an associated mana_recv_buf_oob.
  	 */
-	struct mana_recv_buf_oob rx_oobs[];
+	struct mana_recv_buf_oob rx_oobs[] __counted_by(num_rx_buf);
  };
 
  struct mana_tx_qp {

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct ipa_power.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Alex Elder <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  drivers/net/ipa/ipa_power.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ipa/ipa_power.c +1 -1

index 0eaa7a7f3343..e223886123ce 100644
@@ -67,7 +67,7 @@ struct ipa_power {
  	spinlock_t spinlock;	/* used with STOPPED/STARTED power flags */
  	DECLARE_BITMAP(flags, IPA_POWER_FLAG_COUNT);
  	u32 interconnect_count;
-	struct icc_bulk_data interconnect[];
+	struct icc_bulk_data interconnect[] __counted_by(interconnect_count);
  };
 
  /* Initialize interconnects required for IPA operation */

Quoted 7 lines · Kees Cook

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct ipa_power.

Looks good, thanks.

Reviewed-by Alex Elder <[email protected]>

Note that there is some interaction between struct ipa_power_data and struct ipa_power (the former is used to initialize the latter). Both of these contain flexible arrays counted by another field in the structure. It seems possible that the way these are initialized might need slight modification to allow the compiler to do its enforcement; if that's the case, please reach out to me.

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct ipa_power.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Alex Elder <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  drivers/net/ipa/ipa_power.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ipa/ipa_power.c +1 -1

index 0eaa7a7f3343..e223886123ce 100644
@@ -67,7 +67,7 @@ struct ipa_power {
  	spinlock_t spinlock;	/* used with STOPPED/STARTED power flags */
  	DECLARE_BITMAP(flags, IPA_POWER_FLAG_COUNT);
  	u32 interconnect_count;
-	struct icc_bulk_data interconnect[];
+	struct icc_bulk_data interconnect[] __counted_by(interconnect_count);
  };
 
  /* Initialize interconnects required for IPA operation */

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct hwc_dma_buf.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Long Li <[email protected]>

Cc Ajay Sharma <[email protected]>

Cc "K. Y. Srinivasan" <[email protected]>

Cc Haiyang Zhang <[email protected]>

Cc Wei Liu <[email protected]>

Cc Dexuan Cui <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Cc [email protected]

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  include/net/mana/hw_channel.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

include/net/mana/hw_channel.h +1 -1

index 3d3b5c881bc1..158b125692c2 100644
@@ -121,7 +121,7 @@ struct hwc_dma_buf {
  	u32 gpa_mkey;
 
  	u32 num_reqs;
-	struct hwc_work_request reqs[];
+	struct hwc_work_request reqs[] __counted_by(num_reqs);
  };
 
  typedef void hwc_rx_event_handler_t(void *ctx, u32 gdma_rxq_id,

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct dp_meter_instance.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Pravin B Shelar <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  net/openvswitch/meter.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

net/openvswitch/meter.h +1 -1

index 0c33889a8515..013de694221f 100644
@@ -45,7 +45,7 @@ struct dp_meter {
  struct dp_meter_instance {
  	struct rcu_head rcu;
  	u32 n_meters;
-	struct dp_meter __rcu *dp_meters[];
+	struct dp_meter __rcu *dp_meters[] __counted_by(n_meters);
  };
 
  struct dp_meter_table {

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct enetc_psfp_gate.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Claudiu Manoil <[email protected]>

Cc Vladimir Oltean <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  drivers/net/ethernet/freescale/enetc/enetc_qos.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ethernet/freescale/enetc/enetc_qos.c +1 -1

index 2513b44056c1..b65da49dd926 100644
@@ -443,7 +443,7 @@ struct enetc_psfp_gate {
  	u32 num_entries;
  	refcount_t refcount;
  	struct hlist_node node;
-	struct action_gate_entry entries[];
+	struct action_gate_entry entries[] __counted_by(num_entries);
  };
 
  /* Only enable the green color frame now

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct dp_meter.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Pravin B Shelar <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  net/openvswitch/meter.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

net/openvswitch/meter.h +1 -1

index 013de694221f..ed11cd12b512 100644
@@ -39,7 +39,7 @@ struct dp_meter {
  	u32 max_delta_t;
  	u64 used;
  	struct ovs_flow_stats stats;
-	struct dp_meter_band bands[];
+	struct dp_meter_band bands[] __counted_by(n_bands);
  };
 
  struct dp_meter_instance {

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct mediatable.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc Shaokun Zhang <[email protected]>

Cc [email protected]

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  drivers/net/ethernet/dec/tulip/tulip.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

drivers/net/ethernet/dec/tulip/tulip.h +1 -1

index 0ed598dc7569..bd786dfbc066 100644
@@ -381,7 +381,7 @@ struct mediatable {
  	unsigned has_reset:6;
  	u32 csr15dir;
  	u32 csr15val;		/* 21143 NWay setting. */
-	struct medialeaf mleaf[];
+	struct medialeaf mleaf[] __counted_by(leafcount);
  };
 
 

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct tc_pedit. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Jamal Hadi Salim <[email protected]>

Cc Cong Wang <[email protected]>

Cc Jiri Pirko <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
 net/sched/act_pedit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

net/sched/act_pedit.c +1 -1

index 1ef8fcfa9997..77c407eff3b0 100644
@@ -515,11 +515,11 @@ static int tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a,
 		spin_unlock_bh(&p->tcf_lock);
 		return -ENOBUFS;
 	}
+	opt->nkeys = parms->tcfp_nkeys;
 
 	memcpy(opt->keys, parms->tcfp_keys,
 	       flex_array_size(opt, keys, parms->tcfp_nkeys));
 	opt->index = p->tcf_index;
-	opt->nkeys = parms->tcfp_nkeys;
 	opt->flags = parms->tcfp_flags;
 	opt->action = p->tcf_action;
 	opt->refcnt = refcount_read(&p->tcf_refcnt) - ref;

Signature · 1 line

2.34.1

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct tc_pedit. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Jamal Hadi Salim <[email protected]>

Cc Cong Wang <[email protected]>

Cc Jiri Pirko <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
 net/sched/act_pedit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

net/sched/act_pedit.c +1 -1

index 1ef8fcfa9997..77c407eff3b0 100644
@@ -515,11 +515,11 @@ static int tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a,
 		spin_unlock_bh(&p->tcf_lock);
 		return -ENOBUFS;
 	}
+	opt->nkeys = parms->tcfp_nkeys;
 
 	memcpy(opt->keys, parms->tcfp_keys,
 	       flex_array_size(opt, keys, parms->tcfp_nkeys));
 	opt->index = p->tcf_index;
-	opt->nkeys = parms->tcfp_nkeys;
 	opt->flags = parms->tcfp_flags;
 	opt->action = p->tcf_action;
 	opt->refcnt = refcount_read(&p->tcf_refcnt) - ref;

Signature · 1 line

2.34.1

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct tc_pedit.

Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Jamal Hadi Salim <[email protected]>

Cc Cong Wang <[email protected]>

Cc Jiri Pirko <[email protected]>

Cc "David S. Miller" <[email protected]>

Cc Eric Dumazet <[email protected]>

Cc Jakub Kicinski <[email protected]>

Cc Paolo Abeni <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  net/sched/act_pedit.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

net/sched/act_pedit.c +1 -1

index 1ef8fcfa9997..77c407eff3b0 100644
@@ -515,11 +515,11 @@ static int tcf_pedit_dump(struct sk_buff *skb, struct tc_action *a,
  		spin_unlock_bh(&p->tcf_lock);
  		return -ENOBUFS;
  	}
+	opt->nkeys = parms->tcfp_nkeys;
 
  	memcpy(opt->keys, parms->tcfp_keys,
  	       flex_array_size(opt, keys, parms->tcfp_nkeys));
  	opt->index = p->tcf_index;
-	opt->nkeys = parms->tcfp_nkeys;
  	opt->flags = parms->tcfp_flags;
  	opt->action = p->tcf_action;
  	opt->refcnt = refcount_read(&p->tcf_refcnt) - ref;

This is the batch 1 of patches touching netdev for preparing for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by to structs that would benefit from the annotation.

Since the element count member must be set before accessing the annotated flexible array member, some patches also move the member's initialization earlier. (These are noted in the individual patches.)

Kees Cook (14):
ipv4: Annotate struct fib_info with __counted_by ipv4/igmp: Annotate struct ip_sf_socklist with __counted_by
ipv6: Annotate struct ip6_sf_socklist with __counted_by
net: hns: Annotate struct ppe_common_cb with __counted_by
net: enetc: Annotate struct enetc_int_vector with __counted_by

net: hisilicon: Annotate struct rcb_common_cb with __counted_by
net: mana: Annotate struct mana_rxq with __counted_by
net: ipa: Annotate struct ipa_power with __counted_by
net: mana: Annotate struct hwc_dma_buf with __counted_by
net: openvswitch: Annotate struct dp_meter_instance with __counted_by
net: enetc: Annotate struct enetc_psfp_gate with __counted_by
net: openvswitch: Annotate struct dp_meter with __counted_by
net: tulip: Annotate struct mediatable with __counted_by

net: sched: Annotate struct tc_pedit with __counted_by

Quoted 3 lines

Since the element count member must be set before accessing the annotated flexible array member, some patches also move the member's initialization earlier. (These are noted in the individual patches.)

Hi, just checking on this batch of changes. Is it possible to take the 1-13 subset:

Quoted 6 lines · On Wed, 27 Sep 2023 08:57:36 -0700 Kees Cook wrote:

Quoted 3 lines

Since the element count member must be set before accessing the annotated flexible array member, some patches also move the member's initialization earlier. (These are noted in the individual patches.)

Hi, just checking on this batch of changes. Is it possible to take the 1-13 subset:

On it, sorry for the delay.