From 3e71ea6dca1d585692b645aaf3b8cc58f6e5eb35 Mon Sep 17 00:00:00 2001 From: Bill Wendling Date: Mon, 28 Sep 2026 04:45:13 +0000 Subject: firmware: cs_dsp: Annotate struct cs_dsp_coeff_ctl with __counted_by_ptr Annotate the 'cache' pointer member of 'struct cs_dsp_coeff_ctl' with the '__counted_by_ptr' attribute. This allows the compiler and KASAN to perform run-time bounds checking on accesses to the 'cache' buffer, preventing potential out-of-bounds reads or writes. The 'cache' pointer points to a buffer of size 'len' bytes, allocated to hold the cached value of a DSP coefficient control. The 'cache' and 'len' are initialized in 'cs_dsp_create_control()'. Every subsequent access to 'ctl->cache' is strictly validated to ensure that it lies within the bounds of 'ctl->len'. Cc: codemender-patching+linux@google.com Assisted-by: LLM Signed-off-by: Bill Wendling Reviewed-by: Richard Fitzgerald Link: https://patch.msgid.link/20260928044513.1330392-1-morbo@google.com Signed-off-by: Mark Brown --- include/linux/firmware/cirrus/cs_dsp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include/linux') diff --git a/include/linux/firmware/cirrus/cs_dsp.h b/include/linux/firmware/cirrus/cs_dsp.h index 4e3baa557068..6aa1e1b2b4a5 100644 --- a/include/linux/firmware/cirrus/cs_dsp.h +++ b/include/linux/firmware/cirrus/cs_dsp.h @@ -96,7 +96,7 @@ struct cs_dsp_alg_region { struct cs_dsp_coeff_ctl { struct list_head list; struct cs_dsp *dsp; - void *cache; + void *cache __counted_by_ptr(len); const char *fw_name; /* Subname is needed to match with firmware */ const char *subname; -- cgit v1.2.3