usb: gadget: f_midi: Annotate struct f_midi with __counted_by

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct f_midi. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci

Cc Greg Kroah-Hartman <[email protected]>

Cc John Keeping <[email protected]>

Cc Peter Chen <[email protected]>

Cc Hulk Robot <[email protected]>

Cc Allen Pais <[email protected]>

Cc Will McVicker <[email protected]>

Cc Davidlohr Bueso <[email protected]>

Cc Zhang Qilong <[email protected]>

Cc [email protected]

Signed-off-by Kees Cook <[email protected]>

---
  drivers/usb/gadget/function/f_midi.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

drivers/usb/gadget/function/f_midi.c +2 -2

index 2d02f25f9597..033e347554db 100644
@@ -99,7 +99,7 @@ struct f_midi {
  	unsigned int in_last_port;
  	unsigned char free_ref;
 
-	struct gmidi_in_port	in_ports_array[/* in_ports */];
+	struct gmidi_in_port	in_ports_array[] __counted_by(in_ports);
  };
 
  static inline struct f_midi *func_to_midi(struct usb_function *f)

@@ -1349,6 +1349,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
  		status = -ENOMEM;
  		goto setup_fail;
  	}
+	midi->in_ports = opts->in_ports;
 
  	for (i = 0; i < opts->in_ports; i++)
  		midi->in_ports_array[i].cable = i;

@@ -1359,7 +1360,6 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
  		status = -ENOMEM;
  		goto midi_free;
  	}
-	midi->in_ports = opts->in_ports;
  	midi->out_ports = opts->out_ports;
  	midi->index = opts->index;
  	midi->buflen = opts->buflen;

Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).

As found with Coccinelle[1], add __counted_by for struct f_midi. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.

[...]