diff options
| author | Bill Wendling <morbo@google.com> | 2026-09-25 21:09:12 +0000 |
|---|---|---|
| committer | Takashi Sakamoto <o-takashi@sakamocchi.jp> | 2026-09-25 21:09:12 +0000 |
| commit | a1eae4befca272c238b6e832bbf27f49a5e03825 (patch) | |
| tree | a617e58a0b2536ba0d991f76477f15f42f728e6f /include/linux | |
| parent | 76ef77d7e6cba02cb7b691e874389e3333ece969 (diff) | |
firewire: core: add __counted_by_ptr to struct fw_packet
In 'struct fw_packet', the 'payload' field points to a buffer of size
'payload_length' bytes. To enable compiler bounds checking (via KASAN
and __builtin_dynamic_object_size), add the '__counted_by_ptr' attribute
to the 'payload' pointer, associated with the 'payload_length' count.
A thorough analysis of all allocation and initialization points for
'struct fw_packet' was conducted. The pointer and its length are
assigned together.
Because the count field is always correctly initialized before the
pointer is accessed, the '__counted_by_ptr' attribute is fully safe and
will not cause runtime false positives or panics.
Cc: codemender-patching+linux@google.com
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
Link: https://lore.kernel.org/r/20260925210912.113052-1-morbo@google.com
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/firewire.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/linux/firewire.h b/include/linux/firewire.h index 91a89e812832..9d5a42724f1a 100644 --- a/include/linux/firewire.h +++ b/include/linux/firewire.h @@ -331,7 +331,7 @@ struct fw_packet { int generation; u32 header[4]; size_t header_length; - void *payload; + void *payload __counted_by_ptr(payload_length); size_t payload_length; dma_addr_t payload_bus; bool payload_mapped; |