* [PATCH] crypto: hisilicon/qm - annotate cap_tables with __counted_by_ptr
@ 2026-09-23 6:01 Bill Wendling
2026-09-23 6:11 ` Gustavo A. R. Silva
2026-09-23 7:09 ` liulongfang
0 siblings, 2 replies; 3+ messages in thread
From: Bill Wendling @ 2026-09-23 6:01 UTC (permalink / raw)
To: Zhiqi Song, Longfang Liu, Herbert Xu, David S. Miller,
Weili Qian, Zhou Wang, Chenghai Huang
Cc: Kees Cook, Gustavo A. R. Silva, linux-crypto, linux-kernel,
linux-hardening, Bill Wendling, codemender-patching+linux
Annotate the 'qm_cap_table' and 'dev_cap_table' pointer fields in
'struct hisi_qm_cap_tables' with the '__counted_by_ptr' attribute.
This improves bounds checking via CONFIG_UBSAN_BOUNDS and
CONFIG_FORTIFY_SOURCE, allowing KASAN and compiler diagnostics to
detect out-of-bounds accesses.
The 'qm_cap_table' pointer is associated with 'qm_cap_size' which
specifies its element count. Similarly, 'dev_cap_table' is associated
with 'dev_cap_size'.
To ensure safety under compiler instrumentation, the assignments in the
initialization paths have been updated to set the 'size'/'count' fields
prior to setting the pointer fields. This prevents any transient state
where the pointer is valid but the count is 0 (or uninitialized),
ensuring that subsequent accesses to these tables do not trigger
false-positive bounds check panics.
Cc: codemender-patching+linux@google.com
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
---
drivers/crypto/hisilicon/hpre/hpre_main.c | 2 +-
drivers/crypto/hisilicon/qm.c | 2 +-
drivers/crypto/hisilicon/sec2/sec_main.c | 2 +-
drivers/crypto/hisilicon/zip/zip_main.c | 2 +-
include/linux/hisi_acc_qm.h | 4 ++--
5 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
index b6903fce6071..4a1b2de476f5 100644
--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
+++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
@@ -1234,8 +1234,8 @@ static int hpre_pre_store_cap_reg(struct hisi_qm *qm)
return -EINVAL;
}
- qm->cap_tables.dev_cap_table = hpre_cap;
qm->cap_tables.dev_cap_size = size;
+ qm->cap_tables.dev_cap_table = hpre_cap;
return 0;
}
diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
index c01966a4a33f..7d13476451e3 100644
--- a/drivers/crypto/hisilicon/qm.c
+++ b/drivers/crypto/hisilicon/qm.c
@@ -5743,8 +5743,8 @@ static int qm_pre_store_caps(struct hisi_qm *qm)
i, qm->cap_ver);
}
- qm->cap_tables.qm_cap_table = qm_cap;
qm->cap_tables.qm_cap_size = size;
+ qm->cap_tables.qm_cap_table = qm_cap;
return 0;
}
diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
index 752565200c16..ac423d016998 100644
--- a/drivers/crypto/hisilicon/sec2/sec_main.c
+++ b/drivers/crypto/hisilicon/sec2/sec_main.c
@@ -1285,8 +1285,8 @@ static int sec_pre_store_cap_reg(struct hisi_qm *qm)
i, qm->cap_ver);
}
- qm->cap_tables.dev_cap_table = sec_cap;
qm->cap_tables.dev_cap_size = size;
+ qm->cap_tables.dev_cap_table = sec_cap;
return 0;
}
diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
index 706a73656977..10091ad4a6a8 100644
--- a/drivers/crypto/hisilicon/zip/zip_main.c
+++ b/drivers/crypto/hisilicon/zip/zip_main.c
@@ -1400,8 +1400,8 @@ static int zip_pre_store_cap_reg(struct hisi_qm *qm)
i, qm->cap_ver);
}
- qm->cap_tables.dev_cap_table = zip_cap;
qm->cap_tables.dev_cap_size = size;
+ qm->cap_tables.dev_cap_table = zip_cap;
return 0;
}
diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h
index f7570a409905..8dc49fa2123b 100644
--- a/include/linux/hisi_acc_qm.h
+++ b/include/linux/hisi_acc_qm.h
@@ -332,9 +332,9 @@ struct hisi_qm_cap_record {
struct hisi_qm_cap_tables {
u32 qm_cap_size;
- struct hisi_qm_cap_record *qm_cap_table;
+ struct hisi_qm_cap_record *qm_cap_table __counted_by_ptr(qm_cap_size);
u32 dev_cap_size;
- struct hisi_qm_cap_record *dev_cap_table;
+ struct hisi_qm_cap_record *dev_cap_table __counted_by_ptr(dev_cap_size);
};
struct hisi_qm_list {
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] crypto: hisilicon/qm - annotate cap_tables with __counted_by_ptr
2026-09-23 6:01 [PATCH] crypto: hisilicon/qm - annotate cap_tables with __counted_by_ptr Bill Wendling
@ 2026-09-23 6:11 ` Gustavo A. R. Silva
2026-09-23 7:09 ` liulongfang
1 sibling, 0 replies; 3+ messages in thread
From: Gustavo A. R. Silva @ 2026-09-23 6:11 UTC (permalink / raw)
To: Bill Wendling, Zhiqi Song, Longfang Liu, Herbert Xu,
David S. Miller, Weili Qian, Zhou Wang, Chenghai Huang
Cc: Kees Cook, Gustavo A. R. Silva, linux-crypto, linux-kernel,
linux-hardening, codemender-patching+linux
On 9/23/26 15:01, Bill Wendling wrote:
> Annotate the 'qm_cap_table' and 'dev_cap_table' pointer fields in
> 'struct hisi_qm_cap_tables' with the '__counted_by_ptr' attribute.
> This improves bounds checking via CONFIG_UBSAN_BOUNDS and
> CONFIG_FORTIFY_SOURCE, allowing KASAN and compiler diagnostics to
> detect out-of-bounds accesses.
>
> The 'qm_cap_table' pointer is associated with 'qm_cap_size' which
> specifies its element count. Similarly, 'dev_cap_table' is associated
> with 'dev_cap_size'.
>
> To ensure safety under compiler instrumentation, the assignments in the
> initialization paths have been updated to set the 'size'/'count' fields
> prior to setting the pointer fields. This prevents any transient state
> where the pointer is valid but the count is 0 (or uninitialized),
> ensuring that subsequent accesses to these tables do not trigger
> false-positive bounds check panics.
>
> Cc: codemender-patching+linux@google.com
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <morbo@google.com>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Thanks
-Gustavo
> ---
> drivers/crypto/hisilicon/hpre/hpre_main.c | 2 +-
> drivers/crypto/hisilicon/qm.c | 2 +-
> drivers/crypto/hisilicon/sec2/sec_main.c | 2 +-
> drivers/crypto/hisilicon/zip/zip_main.c | 2 +-
> include/linux/hisi_acc_qm.h | 4 ++--
> 5 files changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
> index b6903fce6071..4a1b2de476f5 100644
> --- a/drivers/crypto/hisilicon/hpre/hpre_main.c
> +++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
> @@ -1234,8 +1234,8 @@ static int hpre_pre_store_cap_reg(struct hisi_qm *qm)
> return -EINVAL;
> }
>
> - qm->cap_tables.dev_cap_table = hpre_cap;
> qm->cap_tables.dev_cap_size = size;
> + qm->cap_tables.dev_cap_table = hpre_cap;
>
> return 0;
> }
> diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
> index c01966a4a33f..7d13476451e3 100644
> --- a/drivers/crypto/hisilicon/qm.c
> +++ b/drivers/crypto/hisilicon/qm.c
> @@ -5743,8 +5743,8 @@ static int qm_pre_store_caps(struct hisi_qm *qm)
> i, qm->cap_ver);
> }
>
> - qm->cap_tables.qm_cap_table = qm_cap;
> qm->cap_tables.qm_cap_size = size;
> + qm->cap_tables.qm_cap_table = qm_cap;
>
> return 0;
> }
> diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
> index 752565200c16..ac423d016998 100644
> --- a/drivers/crypto/hisilicon/sec2/sec_main.c
> +++ b/drivers/crypto/hisilicon/sec2/sec_main.c
> @@ -1285,8 +1285,8 @@ static int sec_pre_store_cap_reg(struct hisi_qm *qm)
> i, qm->cap_ver);
> }
>
> - qm->cap_tables.dev_cap_table = sec_cap;
> qm->cap_tables.dev_cap_size = size;
> + qm->cap_tables.dev_cap_table = sec_cap;
>
> return 0;
> }
> diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
> index 706a73656977..10091ad4a6a8 100644
> --- a/drivers/crypto/hisilicon/zip/zip_main.c
> +++ b/drivers/crypto/hisilicon/zip/zip_main.c
> @@ -1400,8 +1400,8 @@ static int zip_pre_store_cap_reg(struct hisi_qm *qm)
> i, qm->cap_ver);
> }
>
> - qm->cap_tables.dev_cap_table = zip_cap;
> qm->cap_tables.dev_cap_size = size;
> + qm->cap_tables.dev_cap_table = zip_cap;
>
> return 0;
> }
> diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h
> index f7570a409905..8dc49fa2123b 100644
> --- a/include/linux/hisi_acc_qm.h
> +++ b/include/linux/hisi_acc_qm.h
> @@ -332,9 +332,9 @@ struct hisi_qm_cap_record {
>
> struct hisi_qm_cap_tables {
> u32 qm_cap_size;
> - struct hisi_qm_cap_record *qm_cap_table;
> + struct hisi_qm_cap_record *qm_cap_table __counted_by_ptr(qm_cap_size);
> u32 dev_cap_size;
> - struct hisi_qm_cap_record *dev_cap_table;
> + struct hisi_qm_cap_record *dev_cap_table __counted_by_ptr(dev_cap_size);
> };
>
> struct hisi_qm_list {
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] crypto: hisilicon/qm - annotate cap_tables with __counted_by_ptr
2026-09-23 6:01 [PATCH] crypto: hisilicon/qm - annotate cap_tables with __counted_by_ptr Bill Wendling
2026-09-23 6:11 ` Gustavo A. R. Silva
@ 2026-09-23 7:09 ` liulongfang
1 sibling, 0 replies; 3+ messages in thread
From: liulongfang @ 2026-09-23 7:09 UTC (permalink / raw)
To: Bill Wendling, Zhiqi Song, Herbert Xu, David S. Miller,
Weili Qian, Zhou Wang, Chenghai Huang
Cc: Kees Cook, Gustavo A. R. Silva, linux-crypto, linux-kernel,
linux-hardening, codemender-patching+linux
On 2026/9/23 14:01, Bill Wendling wrote:
> Annotate the 'qm_cap_table' and 'dev_cap_table' pointer fields in
> 'struct hisi_qm_cap_tables' with the '__counted_by_ptr' attribute.
> This improves bounds checking via CONFIG_UBSAN_BOUNDS and
> CONFIG_FORTIFY_SOURCE, allowing KASAN and compiler diagnostics to
> detect out-of-bounds accesses.
>
> The 'qm_cap_table' pointer is associated with 'qm_cap_size' which
> specifies its element count. Similarly, 'dev_cap_table' is associated
> with 'dev_cap_size'.
>
> To ensure safety under compiler instrumentation, the assignments in the
> initialization paths have been updated to set the 'size'/'count' fields
> prior to setting the pointer fields. This prevents any transient state
> where the pointer is valid but the count is 0 (or uninitialized),
> ensuring that subsequent accesses to these tables do not trigger
> false-positive bounds check panics.
>
> Cc: codemender-patching+linux@google.com
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <morbo@google.com>
> ---
> drivers/crypto/hisilicon/hpre/hpre_main.c | 2 +-
> drivers/crypto/hisilicon/qm.c | 2 +-
> drivers/crypto/hisilicon/sec2/sec_main.c | 2 +-
> drivers/crypto/hisilicon/zip/zip_main.c | 2 +-
> include/linux/hisi_acc_qm.h | 4 ++--
> 5 files changed, 6 insertions(+), 6 deletions(-)
>
Reviewed-by: Longfang Liu <liulongfang@huawei.com>
Thanks.
Longfang.
> diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
> index b6903fce6071..4a1b2de476f5 100644
> --- a/drivers/crypto/hisilicon/hpre/hpre_main.c
> +++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
> @@ -1234,8 +1234,8 @@ static int hpre_pre_store_cap_reg(struct hisi_qm *qm)
> return -EINVAL;
> }
>
> - qm->cap_tables.dev_cap_table = hpre_cap;
> qm->cap_tables.dev_cap_size = size;
> + qm->cap_tables.dev_cap_table = hpre_cap;
>
> return 0;
> }
> diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
> index c01966a4a33f..7d13476451e3 100644
> --- a/drivers/crypto/hisilicon/qm.c
> +++ b/drivers/crypto/hisilicon/qm.c
> @@ -5743,8 +5743,8 @@ static int qm_pre_store_caps(struct hisi_qm *qm)
> i, qm->cap_ver);
> }
>
> - qm->cap_tables.qm_cap_table = qm_cap;
> qm->cap_tables.qm_cap_size = size;
> + qm->cap_tables.qm_cap_table = qm_cap;
>
> return 0;
> }
> diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
> index 752565200c16..ac423d016998 100644
> --- a/drivers/crypto/hisilicon/sec2/sec_main.c
> +++ b/drivers/crypto/hisilicon/sec2/sec_main.c
> @@ -1285,8 +1285,8 @@ static int sec_pre_store_cap_reg(struct hisi_qm *qm)
> i, qm->cap_ver);
> }
>
> - qm->cap_tables.dev_cap_table = sec_cap;
> qm->cap_tables.dev_cap_size = size;
> + qm->cap_tables.dev_cap_table = sec_cap;
>
> return 0;
> }
> diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
> index 706a73656977..10091ad4a6a8 100644
> --- a/drivers/crypto/hisilicon/zip/zip_main.c
> +++ b/drivers/crypto/hisilicon/zip/zip_main.c
> @@ -1400,8 +1400,8 @@ static int zip_pre_store_cap_reg(struct hisi_qm *qm)
> i, qm->cap_ver);
> }
>
> - qm->cap_tables.dev_cap_table = zip_cap;
> qm->cap_tables.dev_cap_size = size;
> + qm->cap_tables.dev_cap_table = zip_cap;
>
> return 0;
> }
> diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h
> index f7570a409905..8dc49fa2123b 100644
> --- a/include/linux/hisi_acc_qm.h
> +++ b/include/linux/hisi_acc_qm.h
> @@ -332,9 +332,9 @@ struct hisi_qm_cap_record {
>
> struct hisi_qm_cap_tables {
> u32 qm_cap_size;
> - struct hisi_qm_cap_record *qm_cap_table;
> + struct hisi_qm_cap_record *qm_cap_table __counted_by_ptr(qm_cap_size);
> u32 dev_cap_size;
> - struct hisi_qm_cap_record *dev_cap_table;
> + struct hisi_qm_cap_record *dev_cap_table __counted_by_ptr(dev_cap_size);
> };
>
> struct hisi_qm_list {
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-23 7:09 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-23 6:01 [PATCH] crypto: hisilicon/qm - annotate cap_tables with __counted_by_ptr Bill Wendling
2026-09-23 6:11 ` Gustavo A. R. Silva
2026-09-23 7:09 ` liulongfang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®