On Fri, Sep 22, 2023 at 10:28:56AM -0700, Kees Cook wrote: > Prepare for the coming implementation by GCC and Clang of the __counted_by > attribute. Flexible array members annotated with __counted_by can have > their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS > (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family > functions). > > As found with Coccinelle[1], add __counted_by for struct tc_pedit. > Additionally, since the element count member must be set before accessing > the annotated flexible array member, move its initialization earlier. > > [1] > https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci > > Cc: Jamal Hadi Salim <[email protected]> > Cc: Cong Wang <[email protected]> > Cc: Jiri Pirko <[email protected]> > Cc: "David S. Miller" <[email protected]> > Cc: Eric Dumazet <[email protected]> > Cc: Jakub Kicinski <[email protected]> > Cc: Paolo Abeni <[email protected]> > Cc: [email protected] > Signed-off-by: Kees Cook <[email protected]> > --- > net/sched/act_pedit.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c > index 1ef8fcfa9997..77c407eff3b0 100644 > --- a/net/sched/act_pedit.c > +++ b/net/sched/act_pedit.c > @@ -515,11 +515,11 @@ static int tcf_pedit_dump(struct sk_buff *skb, struct > tc_action *a, > spin_unlock_bh(&p->tcf_lock); > return -ENOBUFS; > } > + opt->nkeys = parms->tcfp_nkeys; > > memcpy(opt->keys, parms->tcfp_keys, > flex_array_size(opt, keys, parms->tcfp_nkeys)); > opt->index = p->tcf_index; > - opt->nkeys = parms->tcfp_nkeys; > opt->flags = parms->tcfp_flags; > opt->action = p->tcf_action; > opt->refcnt = refcount_read(&p->tcf_refcnt) - ref; > -- > 2.34.1
Gustavo pointed out that the annotation half of this patch in missing. My mistake! I will figure out where it went. :P Ah, the joys of splitting up a treewide patch series... -- Kees Cook
