The 'const char *buf' pointer in 'struct fpga_image_info' is used to hold the FPGA image data, and its element count is stored in 'size_t count'. To strengthen runtime boundary checks via KASAN and '__builtin_dynamic_object_size', annotate the 'buf' field with the '__counted_by_ptr' attribute, pointing to 'count'.
All allocation and assignment paths of 'struct fpga_image_info' have been verified to ensure that 'count' is initialized before or alongside 'buf', and 'buf' is never accessed before 'count' is set. Cc: [email protected] Assisted-by: LLM Signed-off-by: Bill Wendling <[email protected]> --- include/linux/fpga/fpga-mgr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/fpga/fpga-mgr.h b/include/linux/fpga/fpga-mgr.h index 0d4fe068f3d8..fb9b0978bd34 100644 --- a/include/linux/fpga/fpga-mgr.h +++ b/include/linux/fpga/fpga-mgr.h @@ -103,7 +103,7 @@ struct fpga_image_info { u32 config_complete_timeout_us; char *firmware_name; struct sg_table *sgt; - const char *buf; + const char *buf __counted_by_ptr(count); size_t count; size_t header_size; size_t data_size; -- 2.56.0.rc1.315.gc6ed9934b7-goog
