On 23/09/2026 07:16, Bill Wendling wrote:
The compiler attribute __counted_by_ptr can be used by KASAN and UBSAN
to detect out-of-bounds accesses to pointer fields in structs where a
corresponding element count field is available.
In "struct iio_gts", there are multiple pointer fields associated with
an element count. This patch annotates these pointer fields with
"__counted_by_ptr" to improve runtime safety:
- 'hwgain_table': counted by 'num_hwgain'
- 'itime_table': counted by 'num_itime'
- 'per_time_avail_scale_tables': counted by 'num_itime'
- 'avail_all_scales_table': counted by 'num_avail_all_scales'
- 'avail_time_tables': counted by 'num_avail_time_tables'
To ensure that the count is set correctly before any pointer is
accessed or assigned, we update "iio_init_iio_gts()" to set the counts
prior to assigning the pointers.
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Bill Wendling <[email protected]>
I like this! Thanks!
Acked-by: Matti Vaittinen <[email protected]>
---
drivers/iio/industrialio-gts-helper.c | 4 ++--
include/linux/iio/iio-gts-helper.h | 10 +++++-----
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/iio/industrialio-gts-helper.c
b/drivers/iio/industrialio-gts-helper.c
index 4f52dc373abf..4de6324fd923 100644
--- a/drivers/iio/industrialio-gts-helper.c
+++ b/drivers/iio/industrialio-gts-helper.c
@@ -652,10 +652,10 @@ static int iio_init_iio_gts(int max_scale_int, int
max_scale_nano,
if (ret)
return ret;
- gts->hwgain_table = gain_tbl;
gts->num_hwgain = num_gain;
- gts->itime_table = tim_tbl;
+ gts->hwgain_table = gain_tbl;
gts->num_itime = num_times;
+ gts->itime_table = tim_tbl;
return iio_gts_sanity_check(gts);
}
diff --git a/include/linux/iio/iio-gts-helper.h
b/include/linux/iio/iio-gts-helper.h
index 66f830ab9b49..7e7d3396ff1a 100644
--- a/include/linux/iio/iio-gts-helper.h
+++ b/include/linux/iio/iio-gts-helper.h
@@ -58,14 +58,14 @@ struct iio_itime_sel_mul {
struct iio_gts {
u64 max_scale;
- const struct iio_gain_sel_pair *hwgain_table;
+ const struct iio_gain_sel_pair *hwgain_table
__counted_by_ptr(num_hwgain);
int num_hwgain;
- const struct iio_itime_sel_mul *itime_table;
+ const struct iio_itime_sel_mul *itime_table __counted_by_ptr(num_itime);
int num_itime;
- int **per_time_avail_scale_tables;
- int *avail_all_scales_table;
+ int **per_time_avail_scale_tables __counted_by_ptr(num_itime);
+ int *avail_all_scales_table __counted_by_ptr(num_avail_all_scales);
int num_avail_all_scales;
- int *avail_time_tables;
+ int *avail_time_tables __counted_by_ptr(num_avail_time_tables);
int num_avail_time_tables;
};
--
Matti Vaittinen
Linux kernel developer at ROHM Semiconductors
Oulu Finland
~~ When things go utterly wrong vim users can always type :help! ~~
