On 8/23/26 06:35, Bill Wendling wrote:
For hardening and catching out-of-bounds accesses to the 'entries' pointer field in 'struct stack_trace', associate it with its count field 'max_entries' using the __counted_by_ptr attribute. An analysis of the codebase reveals that 'struct stack_trace' is instantiated and initialized across several entry points in 'kernel/stacktrace.c'. In each execution path, 'trace.entries' is assigned a buffer of size 'size', and 'trace.max_entries' is assigned 'size' concurrently within the structure's initializer block. The pointer is not accessed before the count is set. Because 'trace.entries' is always assigned at the same time as 'trace.max_entries' during initialization and is never reallocated or accessed beforehand, there are no uninitialized access windows. The 'max_entries' field accurately holds the exact element count of the buffer allocated for the 'entries' pointer, ensuring that compiler fortification and KASAN bounds checks using __counted_by_ptr do not trigger false-positive bounds checks or runtime panics. Assisted-by: Gemini Next Signed-off-by: Bill Wendling <[email protected]>
Reviewed-by: Gustavo A. R. Silva <[email protected]> Thanks -Gustavo
--- Cc: Kees Cook <[email protected]> Cc: "Gustavo A. R. Silva" <[email protected]> Cc: Andrew Morton <[email protected]> Cc: Brendan Higgins <[email protected]> Cc: David Gow <[email protected]> Cc: Rae Moar <[email protected]> Cc: Ryota Sakamoto <[email protected]> Cc: Kuan-Wei Chiu <[email protected]> Cc: Pasha Tatashin <[email protected]> Cc: Dmitry Antipov <[email protected]> Cc: Petr Mladek <[email protected]> Cc: Kir Chou <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] Cc: [email protected] --- include/linux/stacktrace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/stacktrace.h b/include/linux/stacktrace.h index 97455880ac41..fbb0925d8864 100644 --- a/include/linux/stacktrace.h +++ b/include/linux/stacktrace.h @@ -81,7 +81,7 @@ unsigned int filter_irq_stacks(unsigned long *entries, unsigned int nr_entries); /* Internal interfaces. Do not use in generic code */ struct stack_trace { unsigned int nr_entries, max_entries; - unsigned long *entries; + unsigned long *entries __counted_by_ptr(max_entries); unsigned int skip; /* input argument: How many entries to skip */ };
