* [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr
@ 2026-09-23 4:52 Bill Wendling
2026-09-23 5:11 ` Lachlan Hodges
2026-09-23 5:49 ` Gustavo A. R. Silva
0 siblings, 2 replies; 3+ messages in thread
From: Bill Wendling @ 2026-09-23 4:52 UTC (permalink / raw)
To: Kees Cook
Cc: Gustavo A. R. Silva, Nathan Chancellor, Nick Desaulniers,
Justin Stitt, Bryam Vargas, Lachlan Hodges, linux-kernel,
linux-hardening, llvm, Bill Wendling, codemender-patching+linux
The GCC and Clang compilers support the "__counted_by_ptr" attribute on
pointer fields to associate them with an element count in the same
struct. This enables KASAN and UBSan bounds checking to detect
out-of-bounds accesses to the pointer.
In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a
pointer member "ptr" of type "const u8 *" whose size is described by the
"len" member, which is correctly populated with the size of the buffer
before any pointer dereferences.
Cc: codemender-patching+linux@google.com
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
---
include/linux/ieee80211-s1g.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/ieee80211-s1g.h b/include/linux/ieee80211-s1g.h
index 3f9626ad3d97..8f6107782c38 100644
--- a/include/linux/ieee80211-s1g.h
+++ b/include/linux/ieee80211-s1g.h
@@ -349,7 +349,7 @@ struct s1g_tim_aid {
struct s1g_tim_enc_block {
u8 enc_mode;
bool inverse;
- const u8 *ptr;
+ const u8 *ptr __counted_by_ptr(len);
u8 len;
/*
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr
2026-09-23 4:52 [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr Bill Wendling
@ 2026-09-23 5:11 ` Lachlan Hodges
2026-09-23 5:49 ` Gustavo A. R. Silva
1 sibling, 0 replies; 3+ messages in thread
From: Lachlan Hodges @ 2026-09-23 5:11 UTC (permalink / raw)
To: Bill Wendling
Cc: Kees Cook, Gustavo A. R. Silva, Nathan Chancellor,
Nick Desaulniers, Justin Stitt, Bryam Vargas, linux-kernel,
linux-hardening, llvm, codemender-patching+linux, johannes,
linux-wireless
+CC Johannes
On Wed, Sep 23, 2026 at 04:52:33AM +0000, Bill Wendling wrote:
> The GCC and Clang compilers support the "__counted_by_ptr" attribute on
> pointer fields to associate them with an element count in the same
> struct. This enables KASAN and UBSan bounds checking to detect
> out-of-bounds accesses to the pointer.
>
> In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a
> pointer member "ptr" of type "const u8 *" whose size is described by the
> "len" member, which is correctly populated with the size of the buffer
> before any pointer dereferences.
>
> Cc: codemender-patching+linux@google.com
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <morbo@google.com>
> ---
> include/linux/ieee80211-s1g.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/linux/ieee80211-s1g.h b/include/linux/ieee80211-s1g.h
> index 3f9626ad3d97..8f6107782c38 100644
> --- a/include/linux/ieee80211-s1g.h
> +++ b/include/linux/ieee80211-s1g.h
> @@ -349,7 +349,7 @@ struct s1g_tim_aid {
> struct s1g_tim_enc_block {
> u8 enc_mode;
> bool inverse;
> - const u8 *ptr;
> + const u8 *ptr __counted_by_ptr(len);
> u8 len;
Sure
Reviewed-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr
2026-09-23 4:52 [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr Bill Wendling
2026-09-23 5:11 ` Lachlan Hodges
@ 2026-09-23 5:49 ` Gustavo A. R. Silva
1 sibling, 0 replies; 3+ messages in thread
From: Gustavo A. R. Silva @ 2026-09-23 5:49 UTC (permalink / raw)
To: Bill Wendling, Kees Cook
Cc: Gustavo A. R. Silva, Nathan Chancellor, Nick Desaulniers,
Justin Stitt, Bryam Vargas, Lachlan Hodges, linux-kernel,
linux-hardening, llvm, codemender-patching+linux
On 9/23/26 13:52, Bill Wendling wrote:
> The GCC and Clang compilers support the "__counted_by_ptr" attribute on
> pointer fields to associate them with an element count in the same
> struct. This enables KASAN and UBSan bounds checking to detect
> out-of-bounds accesses to the pointer.
>
> In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a
> pointer member "ptr" of type "const u8 *" whose size is described by the
> "len" member, which is correctly populated with the size of the buffer
> before any pointer dereferences.
>
> Cc: codemender-patching+linux@google.com
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <morbo@google.com>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Thanks
-Gustavo
> ---
> include/linux/ieee80211-s1g.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/linux/ieee80211-s1g.h b/include/linux/ieee80211-s1g.h
> index 3f9626ad3d97..8f6107782c38 100644
> --- a/include/linux/ieee80211-s1g.h
> +++ b/include/linux/ieee80211-s1g.h
> @@ -349,7 +349,7 @@ struct s1g_tim_aid {
> struct s1g_tim_enc_block {
> u8 enc_mode;
> bool inverse;
> - const u8 *ptr;
> + const u8 *ptr __counted_by_ptr(len);
> u8 len;
>
> /*
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-23 5:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-23 4:52 [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr Bill Wendling
2026-09-23 5:11 ` Lachlan Hodges
2026-09-23 5:49 ` Gustavo A. R. Silva
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®