From: Bill Wendling <[email protected]> Sent: Tuesday, September 22, 2026 10:53
PM
>
> Add the "__counted_by_ptr" attribute to the buffer field of "struct
> vmbus_gpadl". This allows compilers (GCC and Clang) to perform
> compile-time and runtime bounds-checking when KASAN is enabled, preventing
> potential out-of-bounds accesses to the GPADL buffer.
It turns out this "buffer" field is never dereferenced. The value is saved
here only for the purpose of passing into set_memory_encrypted() as
called by vmbus_teardown_gpadl(). The memory *is* referenced, but
through a wraparound mapping created by vmap() from the struct page's
underlying the buffer. The mapping is created in hv_ringbuffer_init().
Given that, is this patch still appropriate?
Michael
>
> The fields "buffer" and "size" of "struct vmbus_gpadl" are assigned
> exactly once, during GPADL establishment inside
> "__vmbus_establish_gpadl()" in "drivers/hv/channel.c".
>
> To ensure that the count field ("size") is initialized before the
> pointer field ("buffer") is assigned, we reorder the assignments in
> "__vmbus_establish_gpadl()" so that "gpadl->size" is written before
> "gpadl->buffer".
>
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <[email protected]>
> ---
> drivers/hv/channel.c | 2 +-
> include/linux/hyperv.h | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
> index 7e4cc6f55237..7042de2dd481 100644
> --- a/drivers/hv/channel.c
> +++ b/drivers/hv/channel.c
> @@ -548,8 +548,8 @@ static int __vmbus_establish_gpadl(struct vmbus_channel
> *channel,
>
> /* At this point, we received the gpadl created msg */
> gpadl->gpadl_handle = gpadlmsg->gpadl;
> - gpadl->buffer = kbuffer;
> gpadl->size = size;
> + gpadl->buffer = kbuffer;
>
>
> cleanup:
> diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
> index 9e109d91aa14..408748a05440 100644
> --- a/include/linux/hyperv.h
> +++ b/include/linux/hyperv.h
> @@ -780,7 +780,7 @@ struct vmbus_device {
> struct vmbus_gpadl {
> u32 gpadl_handle;
> u32 size;
> - void *buffer;
> + void *buffer __counted_by_ptr(size);
> bool decrypted;
> };
>
> --
> 2.55.0.1082.g2b9226bbc0-goog
>
