Skip to contentSkip to conversation

wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr

PATCH In review Bill Wendling 3 participants 3 messages Sep 23

lore
Share & tools
lore

Bill Wendling

author
#0 lore raw

PATCH 1/1 wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr

The GCC and Clang compilers support the "__counted_by_ptr" attribute on pointer fields to associate them with an element count in the same struct. This enables KASAN and UBSan bounds checking to detect out-of-bounds accesses to the pointer.

In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a pointer member "ptr" of type "const u8 *" whose size is described by the "len" member, which is correctly populated with the size of the buffer before any pointer dereferences.

Cc [email protected]
Assisted-by LLM
Signed-off-by Bill Wendling <[email protected]>
---
 include/linux/ieee80211-s1g.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/ieee80211-s1g.h +1 -1
index 3f9626ad3d97..8f6107782c38 100644
@@ -349,7 +349,7 @@ struct s1g_tim_aid {
 struct s1g_tim_enc_block {
 	u8 enc_mode;
 	bool inverse;
-	const u8 *ptr;
+	const u8 *ptr __counted_by_ptr(len);
 	u8 len;
 
 	/*
Signature · 1 line
2.55.0.1082.g2b9226bbc0-goog
Reviewed-by on v1 1/1
#1 lore raw

+CC Johannes

Quoted 22 lines · Bill Wendling

The GCC and Clang compilers support the "__counted_by_ptr" attribute on pointer fields to associate them with an element count in the same struct. This enables KASAN and UBSan bounds checking to detect out-of-bounds accesses to the pointer.

In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a pointer member "ptr" of type "const u8 *" whose size is described by the "len" member, which is correctly populated with the size of the buffer before any pointer dereferences.

Cc [email protected]
Assisted-by LLM
Signed-off-by Bill Wendling <[email protected]>
---
 include/linux/ieee80211-s1g.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/ieee80211-s1g.h +0 -0
index 3f9626ad3d97..8f6107782c38 100644

include/linux/ieee80211-s1g.h struct s1g_tim_aid { · line 353

Quoted 6 lines
include/linux/ieee80211-s1g.h +1 -1
@@ -349,7 +349,7 @@ struct s1g_tim_aid {
 struct s1g_tim_enc_block {
 	u8 enc_mode;
 	bool inverse;
-	const u8 *ptr;
+	const u8 *ptr __counted_by_ptr(len);
 	u8 len;

Sure

Reviewed-by Lachlan Hodges <[email protected]>
Reviewed-by on v1 1/1
#2 lore raw
In reply to Bill Wendling
Quoted 5 lines · Bill Wendling

The GCC and Clang compilers support the "__counted_by_ptr" attribute on pointer fields to associate them with an element count in the same struct. This enables KASAN and UBSan bounds checking to detect out-of-bounds accesses to the pointer.

Quoted 8 lines

In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a pointer member "ptr" of type "const u8 *" whose size is described by the "len" member, which is correctly populated with the size of the buffer before any pointer dereferences.

Cc [email protected]
Assisted-by LLM
Signed-off-by Bill Wendling <[email protected]>
Reviewed-by Gustavo A. R. Silva <[email protected]>

Thanks
-Gustavo

Quoted 17 lines
---
  include/linux/ieee80211-s1g.h | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/ieee80211-s1g.h +1 -1
index 3f9626ad3d97..8f6107782c38 100644
@@ -349,7 +349,7 @@ struct s1g_tim_aid {
  struct s1g_tim_enc_block {
  	u8 enc_mode;
  	bool inverse;
-	const u8 *ptr;
+	const u8 *ptr __counted_by_ptr(len);
  	u8 len;
 
  	/*