In 'struct fw_packet', the 'payload' field points to a buffer of size 'payload_length' bytes. To enable compiler bounds checking (via KASAN and __builtin_dynamic_object_size), add the '__counted_by_ptr' attribute to the 'payload' pointer, associated with the 'payload_length' count.
A thorough analysis of all allocation and initialization points for 'struct fw_packet' was conducted. The pointer and its length are assigned together. Because the count field is always correctly initialized before the pointer is accessed, the '__counted_by_ptr' attribute is fully safe and will not cause runtime false positives or panics. Cc: [email protected] Assisted-by: LLM Signed-off-by: Bill Wendling <[email protected]> --- include/linux/firewire.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/firewire.h b/include/linux/firewire.h index fd35a6570cd8..9f313b47a694 100644 --- a/include/linux/firewire.h +++ b/include/linux/firewire.h @@ -322,7 +322,7 @@ struct fw_packet { int generation; u32 header[4]; size_t header_length; - void *payload; + void *payload __counted_by_ptr(payload_length); size_t payload_length; dma_addr_t payload_bus; bool payload_mapped; -- 2.56.0.rc1.315.gc6ed9934b7-goog
