On Mon, Aug 10, 2026 at 5:18 PM Kees Cook <[email protected]> wrote: > > On Mon, Aug 10, 2026 at 08:41:12PM +0000, Bill Wendling wrote: > > The 'struct fdtable' holds the file descriptor table information, > > including the current file descriptor array 'fd' and its size 'max_fds'. > > To harden the kernel against out-of-bounds accesses, we can annotate the > > 'fd' pointer field with the '__counted_by_ptr' attribute, referencing > > 'max_fds'. > > > > The compiler uses the '__counted_by_ptr' attribute to track the > > size of the memory allocated for the pointer field, enabling > > runtime bounds checks under KASAN and fortified functions. There are > > three places where a 'struct fdtable' is initialized, and in all of > > them, 'max_fds' is set before the 'fd' pointer is accessed or assigned > > in all allocation and initialization places. > > > > No accesses to 'fd' occur before 'max_fds' is set, preventing any > > potential runtime false-positives or panics due to uninitialized count > > fields. > > > > This patch was generated by CodeMender and checked by submitter. > > > > Cc: [email protected] > > Signed-off-by: Bill Wendling <[email protected]> > > --- > > Cc: Alexander Viro <[email protected]> > > Cc: Christian Brauner <[email protected]> > > Cc: Jan Kara <[email protected]> > > Cc: Kees Cook <[email protected]> > > Cc: "Gustavo A. R. Silva" <[email protected]> > > Cc: [email protected] > > Cc: [email protected] > > Cc: [email protected] > > --- > > include/linux/fdtable.h | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/include/linux/fdtable.h b/include/linux/fdtable.h > > index c45306a9f007..3a5c88291125 100644 > > --- a/include/linux/fdtable.h > > +++ b/include/linux/fdtable.h > > @@ -25,7 +25,7 @@ > > > > struct fdtable { > > unsigned int max_fds; > > - struct file __rcu **fd; /* current fd array */ > > + struct file __rcu **fd __counted_by_ptr(max_fds); /* current fd > > array */ > > unsigned long *close_on_exec; > > unsigned long *open_fds; > > unsigned long *full_fds_bits; > > I see the alloc_fdtable test, that's one max_fds assignment, but I also > see dup_fd(), which does the assignment after the newf allocation, so > that looks safe too, but it might be nice to add that allocation path to > the tests too? > Hi Kees,
I added a testcase for the 'dup_fd' path. -bw
