diff options
| author | Bill Wendling <morbo@google.com> | 2026-09-23 06:01:14 +0000 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2026-10-02 18:12:43 +1000 |
| commit | 973eb89550d347aa4bc4e58452cf7a0d13fde29e (patch) | |
| tree | d6e9ea1c90936cb59f17902ca4e3e1a0c33af8bf | |
| parent | 780cd10c8e78f97ed768be229acff0ffd5483477 (diff) | |
crypto: hisilicon/qm - annotate cap_tables with __counted_by_ptr
Annotate the 'qm_cap_table' and 'dev_cap_table' pointer fields in
'struct hisi_qm_cap_tables' with the '__counted_by_ptr' attribute.
This improves bounds checking via CONFIG_UBSAN_BOUNDS and
CONFIG_FORTIFY_SOURCE, allowing KASAN and compiler diagnostics to
detect out-of-bounds accesses.
The 'qm_cap_table' pointer is associated with 'qm_cap_size' which
specifies its element count. Similarly, 'dev_cap_table' is associated
with 'dev_cap_size'.
To ensure safety under compiler instrumentation, the assignments in the
initialization paths have been updated to set the 'size'/'count' fields
prior to setting the pointer fields. This prevents any transient state
where the pointer is valid but the count is 0 (or uninitialized),
ensuring that subsequent accesses to these tables do not trigger
false-positive bounds check panics.
Cc: codemender-patching+linux@google.com
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Longfang Liu <liulongfang@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
| -rw-r--r-- | drivers/crypto/hisilicon/hpre/hpre_main.c | 2 | ||||
| -rw-r--r-- | drivers/crypto/hisilicon/qm.c | 2 | ||||
| -rw-r--r-- | drivers/crypto/hisilicon/sec2/sec_main.c | 2 | ||||
| -rw-r--r-- | drivers/crypto/hisilicon/zip/zip_main.c | 2 | ||||
| -rw-r--r-- | include/linux/hisi_acc_qm.h | 4 |
5 files changed, 6 insertions, 6 deletions
diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c index 03aa11a7a3b4..fd3c34daceb7 100644 --- a/drivers/crypto/hisilicon/hpre/hpre_main.c +++ b/drivers/crypto/hisilicon/hpre/hpre_main.c @@ -1223,8 +1223,8 @@ static int hpre_pre_store_cap_reg(struct hisi_qm *qm) return -EINVAL; } - qm->cap_tables.dev_cap_table = hpre_cap; qm->cap_tables.dev_cap_size = size; + qm->cap_tables.dev_cap_table = hpre_cap; return 0; } diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c index c01966a4a33f..7d13476451e3 100644 --- a/drivers/crypto/hisilicon/qm.c +++ b/drivers/crypto/hisilicon/qm.c @@ -5743,8 +5743,8 @@ static int qm_pre_store_caps(struct hisi_qm *qm) i, qm->cap_ver); } - qm->cap_tables.qm_cap_table = qm_cap; qm->cap_tables.qm_cap_size = size; + qm->cap_tables.qm_cap_table = qm_cap; return 0; } diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c index 752565200c16..ac423d016998 100644 --- a/drivers/crypto/hisilicon/sec2/sec_main.c +++ b/drivers/crypto/hisilicon/sec2/sec_main.c @@ -1285,8 +1285,8 @@ static int sec_pre_store_cap_reg(struct hisi_qm *qm) i, qm->cap_ver); } - qm->cap_tables.dev_cap_table = sec_cap; qm->cap_tables.dev_cap_size = size; + qm->cap_tables.dev_cap_table = sec_cap; return 0; } diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c index 706a73656977..10091ad4a6a8 100644 --- a/drivers/crypto/hisilicon/zip/zip_main.c +++ b/drivers/crypto/hisilicon/zip/zip_main.c @@ -1400,8 +1400,8 @@ static int zip_pre_store_cap_reg(struct hisi_qm *qm) i, qm->cap_ver); } - qm->cap_tables.dev_cap_table = zip_cap; qm->cap_tables.dev_cap_size = size; + qm->cap_tables.dev_cap_table = zip_cap; return 0; } diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h index f7570a409905..8dc49fa2123b 100644 --- a/include/linux/hisi_acc_qm.h +++ b/include/linux/hisi_acc_qm.h @@ -332,9 +332,9 @@ struct hisi_qm_cap_record { struct hisi_qm_cap_tables { u32 qm_cap_size; - struct hisi_qm_cap_record *qm_cap_table; + struct hisi_qm_cap_record *qm_cap_table __counted_by_ptr(qm_cap_size); u32 dev_cap_size; - struct hisi_qm_cap_record *dev_cap_table; + struct hisi_qm_cap_record *dev_cap_table __counted_by_ptr(dev_cap_size); }; struct hisi_qm_list { |