According to 'ath12k_ce_alloc_ring()', annotate flexible array member 'skb' of 'struct ath12k_ce_ring' with '__counted_by()' to improve runtime bounds checking when CONFIG_UBSAN_BOUNDS is enabled. Compile tested only.
Signed-off-by: Dmitry Antipov <[email protected]> --- v2: add related comment in ath12k_ce_alloc_ring() --- drivers/net/wireless/ath/ath12k/ce.c | 3 +++ drivers/net/wireless/ath/ath12k/ce.h | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath12k/ce.c b/drivers/net/wireless/ath/ath12k/ce.c index be0d669d31fc..23d984da2341 100644 --- a/drivers/net/wireless/ath/ath12k/ce.c +++ b/drivers/net/wireless/ath/ath12k/ce.c @@ -550,6 +550,9 @@ ath12k_ce_alloc_ring(struct ath12k_base *ab, int nentries, int desc_sz) if (!ce_ring) return ERR_PTR(-ENOMEM); + /* Note nentries should be set before populating skb[], + * otherwise __counted_by() might raise false positives. + */ ce_ring->nentries = nentries; ce_ring->nentries_mask = nentries - 1; diff --git a/drivers/net/wireless/ath/ath12k/ce.h b/drivers/net/wireless/ath/ath12k/ce.h index 857bc5f9e946..6967e3891030 100644 --- a/drivers/net/wireless/ath/ath12k/ce.h +++ b/drivers/net/wireless/ath/ath12k/ce.h @@ -135,7 +135,7 @@ struct ath12k_ce_ring { u32 hal_ring_id; /* keep last */ - struct sk_buff *skb[]; + struct sk_buff *skb[] __counted_by(nentries); }; struct ath12k_ce_pipe { -- 2.47.0
