+CC Johannes On Wed, Sep 23, 2026 at 04:52:33AM +0000, Bill Wendling wrote: > The GCC and Clang compilers support the "__counted_by_ptr" attribute on > pointer fields to associate them with an element count in the same > struct. This enables KASAN and UBSan bounds checking to detect > out-of-bounds accesses to the pointer. > > In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a > pointer member "ptr" of type "const u8 *" whose size is described by the > "len" member, which is correctly populated with the size of the buffer > before any pointer dereferences. > > Cc: [email protected] > Assisted-by: LLM > Signed-off-by: Bill Wendling <[email protected]> > --- > include/linux/ieee80211-s1g.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/include/linux/ieee80211-s1g.h b/include/linux/ieee80211-s1g.h > index 3f9626ad3d97..8f6107782c38 100644 > --- a/include/linux/ieee80211-s1g.h > +++ b/include/linux/ieee80211-s1g.h > @@ -349,7 +349,7 @@ struct s1g_tim_aid { > struct s1g_tim_enc_block { > u8 enc_mode; > bool inverse; > - const u8 *ptr; > + const u8 *ptr __counted_by_ptr(len); > u8 len;
Sure Reviewed-by: Lachlan Hodges <[email protected]>
