The 'struct hid_bpf' contains a 'device_data' pointer field (of type 'u8 *') and an 'allocated_data' field (of type 'u32') that specifies the size in bytes of the allocated memory for 'device_data'. Since 'device_data' is a pointer to 'u8' (elements of size 1 byte), 'allocated_data' represents the exact count of elements allocated for 'device_data'.
Annotate the 'device_data' field of 'struct hid_bpf' with the '__counted_by_ptr' attribute, pointing to 'allocated_data'. This enables bounds-checking sanitizers (like KASAN and UBSAN) to detect out-of-bounds accesses to 'device_data'. Because the count 'allocated_data' is always set before any access and accurately tracks the allocated buffer size at all times, adding '__counted_by_ptr' will not cause runtime panics or false-positive bounds checks. Cc: [email protected] Assisted-by: LLM Signed-off-by: Bill Wendling <[email protected]> --- v2: Reorder the assignment of the buffer and the count field. It won't generate an exception during execution, but it's a good coding habit that also satisfies LLMs' paranoia. --- drivers/hid/bpf/hid_bpf_dispatch.c | 2 +- include/linux/hid_bpf.h | 10 ++++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c index d46779b63660..fb302d0b9797 100644 --- a/drivers/hid/bpf/hid_bpf_dispatch.c +++ b/drivers/hid/bpf/hid_bpf_dispatch.c @@ -255,8 +255,8 @@ static int __hid_bpf_allocate_data(struct hid_device *hdev, u8 **data, u32 *size if (!alloc_data) return -ENOMEM; - *data = alloc_data; *size = alloc_size; + *data = alloc_data; return 0; } diff --git a/include/linux/hid_bpf.h b/include/linux/hid_bpf.h index 19fffa4574a4..f45fb9cccece 100644 --- a/include/linux/hid_bpf.h +++ b/include/linux/hid_bpf.h @@ -185,10 +185,12 @@ struct hid_bpf_ops { /* stored in each device */ struct hid_bpf { - u8 *device_data; /* allocated when a bpf program of type - * SEC(f.../hid_bpf_device_event) has been attached - * to this HID device - */ + /* + * allocated when a bpf program of type + * SEC(f.../hid_bpf_device_event) has been attached + * to this HID device + */ + u8 *device_data __counted_by_ptr(allocated_data); u32 allocated_data; bool destroyed; /* prevents the assignment of any progs */ -- 2.55.0.1082.g2b9226bbc0-goog
