Messages in this thread | | | Date | Sat, 23 Sep 2023 10:34:44 -0600 | Subject | Re: [PATCH] gpiolib: cdev: Annotate struct linereq with __counted_by | From | "Gustavo A. R. Silva" <> |
| |
On 9/22/23 11:52, Kees Cook wrote: > Prepare for the coming implementation by GCC and Clang of the __counted_by > attribute. Flexible array members annotated with __counted_by can have > their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS > (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family > functions). > > As found with Coccinelle[1], add __counted_by for struct linereq. > Additionally, since the element count member must be set before accessing > the annotated flexible array member, move its initialization earlier. > > [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci > > Cc: Linus Walleij <linus.walleij@linaro.org> > Cc: Bartosz Golaszewski <brgl@bgdev.pl> > Cc: Andy Shevchenko <andy@kernel.org> > Cc: linux-gpio@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Thanks -- Gustavo
> --- > drivers/gpio/gpiolib-cdev.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c > index e39d344feb28..31fc71a612c2 100644 > --- a/drivers/gpio/gpiolib-cdev.c > +++ b/drivers/gpio/gpiolib-cdev.c > @@ -572,7 +572,7 @@ struct linereq { > DECLARE_KFIFO_PTR(events, struct gpio_v2_line_event); > atomic_t seqno; > struct mutex config_mutex; > - struct line lines[]; > + struct line lines[] __counted_by(num_lines); > }; > > #define GPIO_V2_LINE_BIAS_FLAGS \ > @@ -1656,6 +1656,7 @@ static int linereq_create(struct gpio_device *gdev, void __user *ip) > lr = kzalloc(struct_size(lr, lines, ulr.num_lines), GFP_KERNEL); > if (!lr) > return -ENOMEM; > + lr->num_lines = ulr.num_lines; > > lr->gdev = gpio_device_get(gdev); > > @@ -1684,7 +1685,6 @@ static int linereq_create(struct gpio_device *gdev, void __user *ip) > lr->event_buffer_size = GPIO_V2_LINES_MAX * 16; > > atomic_set(&lr->seqno, 0); > - lr->num_lines = ulr.num_lines; > > /* Request each GPIO */ > for (i = 0; i < ulr.num_lines; i++) {
| |