* [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr
@ 2026-09-23 4:52 Bill Wendling
2026-09-23 5:11 ` Lachlan Hodges
2026-09-23 5:49 ` Gustavo A. R. Silva
0 siblings, 2 replies; 3+ messages in thread
From: Bill Wendling @ 2026-09-23 4:52 UTC (permalink / raw)
To: Kees Cook
Cc: Gustavo A. R. Silva, Nathan Chancellor, Nick Desaulniers,
Justin Stitt, Bryam Vargas, Lachlan Hodges, linux-kernel,
linux-hardening, llvm, Bill Wendling, codemender-patching+linux
The GCC and Clang compilers support the "__counted_by_ptr" attribute on
pointer fields to associate them with an element count in the same
struct. This enables KASAN and UBSan bounds checking to detect
out-of-bounds accesses to the pointer.
In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a
pointer member "ptr" of type "const u8 *" whose size is described by the
"len" member, which is correctly populated with the size of the buffer
before any pointer dereferences.
Cc: codemender-patching+linux@google.com
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
---
include/linux/ieee80211-s1g.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/ieee80211-s1g.h b/include/linux/ieee80211-s1g.h
index 3f9626ad3d97..8f6107782c38 100644
--- a/include/linux/ieee80211-s1g.h
+++ b/include/linux/ieee80211-s1g.h
@@ -349,7 +349,7 @@ struct s1g_tim_aid {
struct s1g_tim_enc_block {
u8 enc_mode;
bool inverse;
- const u8 *ptr;
+ const u8 *ptr __counted_by_ptr(len);
u8 len;
/*
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr
2026-09-23 4:52 [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr Bill Wendling
@ 2026-09-23 5:11 ` Lachlan Hodges
2026-09-23 5:49 ` Gustavo A. R. Silva
1 sibling, 0 replies; 3+ messages in thread
From: Lachlan Hodges @ 2026-09-23 5:11 UTC (permalink / raw)
To: Bill Wendling
Cc: Kees Cook, Gustavo A. R. Silva, Nathan Chancellor,
Nick Desaulniers, Justin Stitt, Bryam Vargas, linux-kernel,
linux-hardening, llvm, codemender-patching+linux, johannes,
linux-wireless
+CC Johannes
On Wed, Sep 23, 2026 at 04:52:33AM +0000, Bill Wendling wrote:
> The GCC and Clang compilers support the "__counted_by_ptr" attribute on
> pointer fields to associate them with an element count in the same
> struct. This enables KASAN and UBSan bounds checking to detect
> out-of-bounds accesses to the pointer.
>
> In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a
> pointer member "ptr" of type "const u8 *" whose size is described by the
> "len" member, which is correctly populated with the size of the buffer
> before any pointer dereferences.
>
> Cc: codemender-patching+linux@google.com
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <morbo@google.com>
> ---
> include/linux/ieee80211-s1g.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/linux/ieee80211-s1g.h b/include/linux/ieee80211-s1g.h
> index 3f9626ad3d97..8f6107782c38 100644
> --- a/include/linux/ieee80211-s1g.h
> +++ b/include/linux/ieee80211-s1g.h
> @@ -349,7 +349,7 @@ struct s1g_tim_aid {
> struct s1g_tim_enc_block {
> u8 enc_mode;
> bool inverse;
> - const u8 *ptr;
> + const u8 *ptr __counted_by_ptr(len);
> u8 len;
Sure
Reviewed-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr
2026-09-23 4:52 [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr Bill Wendling
2026-09-23 5:11 ` Lachlan Hodges
@ 2026-09-23 5:49 ` Gustavo A. R. Silva
1 sibling, 0 replies; 3+ messages in thread
From: Gustavo A. R. Silva @ 2026-09-23 5:49 UTC (permalink / raw)
To: Bill Wendling, Kees Cook
Cc: Gustavo A. R. Silva, Nathan Chancellor, Nick Desaulniers,
Justin Stitt, Bryam Vargas, Lachlan Hodges, linux-kernel,
linux-hardening, llvm, codemender-patching+linux
On 9/23/26 13:52, Bill Wendling wrote:
> The GCC and Clang compilers support the "__counted_by_ptr" attribute on
> pointer fields to associate them with an element count in the same
> struct. This enables KASAN and UBSan bounds checking to detect
> out-of-bounds accesses to the pointer.
>
> In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a
> pointer member "ptr" of type "const u8 *" whose size is described by the
> "len" member, which is correctly populated with the size of the buffer
> before any pointer dereferences.
>
> Cc: codemender-patching+linux@google.com
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <morbo@google.com>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Thanks
-Gustavo
> ---
> include/linux/ieee80211-s1g.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/linux/ieee80211-s1g.h b/include/linux/ieee80211-s1g.h
> index 3f9626ad3d97..8f6107782c38 100644
> --- a/include/linux/ieee80211-s1g.h
> +++ b/include/linux/ieee80211-s1g.h
> @@ -349,7 +349,7 @@ struct s1g_tim_aid {
> struct s1g_tim_enc_block {
> u8 enc_mode;
> bool inverse;
> - const u8 *ptr;
> + const u8 *ptr __counted_by_ptr(len);
> u8 len;
>
> /*
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-23 5:49 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-23 4:52 [PATCH] wifi: ieee80211: annotate struct s1g_tim_enc_block with __counted_by_ptr Bill Wendling
2026-09-23 5:11 ` Lachlan Hodges
2026-09-23 5:49 ` Gustavo A. R. Silva
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.