From: Andy Shevchenko <andriy.shevchenko@intel.com>
To: Krzysztof Kozlowski <krzk@kernel.org>
Cc: "Yasin Lee" <yasin.lee.x@gmail.com>,
"Jonathan Cameron" <jic23@kernel.org>,
"David Lechner" <dlechner@baylibre.com>,
"Nuno Sá" <nuno.sa@analog.com>,
"Andy Shevchenko" <andy@kernel.org>,
"Rob Herring" <robh@kernel.org>,
"Krzysztof Kozlowski" <krzk+dt@kernel.org>,
"Conor Dooley" <conor+dt@kernel.org>,
yasin.lee.x@outlook.com, linux-iio@vger.kernel.org,
linux-kernel@vger.kernel.org, devicetree@vger.kernel.org
Subject: Re: [PATCH v2 1/4] iio: proximity: hx9023s: fix out-of-bounds access when copying firmware
Date: Thu, 12 Feb 2026 15:48:38 +0200 [thread overview]
Message-ID: <aY3aNubqU4_41ohi@smile.fi.intel.com> (raw)
In-Reply-To: <20260212-lush-monumental-grouse-e3903d@quoll>
On Thu, Feb 12, 2026 at 12:25:54PM +0100, Krzysztof Kozlowski wrote:
> On Thu, Feb 12, 2026 at 02:26:52PM +0800, Yasin Lee wrote:
> > Initialize fw_size before copying firmware data into the flexible
> > array member to match the __counted_by() annotation. This fixes a
> > potential out-of-bounds access that could lead to a kernel crash.
>
> I don't think so. Code is equivalent and this was just false positive
> because compiler could not deduce that in this case counted_by can be by
> fw->size.
In accordance with [1]:
When finding the element count assignment, it must be reordered
to before any accesses of the PTR->ARRAY itself, otherwise runtime
checking will trigger (i.e. the index of ARRAY will be checked against
COUNTER before COUNTER has been assigned the correct COUNT value).
[1]: https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci#L3
--
With Best Regards,
Andy Shevchenko
next prev parent reply other threads:[~2026-02-12 13:48 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-02-12 6:26 [PATCH v2 0/4] iio: proximity: hx9023s: firmware property, safety fixes Yasin Lee
2026-02-12 6:26 ` [PATCH v2 1/4] iio: proximity: hx9023s: fix out-of-bounds access when copying firmware Yasin Lee
2026-02-12 10:58 ` Andy Shevchenko
2026-02-12 11:25 ` Krzysztof Kozlowski
2026-02-12 13:48 ` Andy Shevchenko [this message]
2026-02-12 16:27 ` Krzysztof Kozlowski
2026-02-12 6:26 ` [PATCH v2 2/4] iio: proximity: hx9023s: Protect against division by zero in set_samp_freq Yasin Lee
2026-02-12 10:55 ` Andy Shevchenko
2026-02-12 16:44 ` Yasin Lee
2026-02-12 20:01 ` Andy Shevchenko
2026-02-12 6:26 ` [PATCH v2 3/4] dt-bindings: iio: proximity: hx9023s: support firmware-name property Yasin Lee
2026-02-12 11:23 ` Krzysztof Kozlowski
2026-02-12 17:36 ` Yasin Lee
2026-02-12 6:26 ` [PATCH v2 4/4] " Yasin Lee
2026-02-12 10:57 ` Andy Shevchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aY3aNubqU4_41ohi@smile.fi.intel.com \
--to=andriy.shevchenko@intel.com \
--cc=andy@kernel.org \
--cc=conor+dt@kernel.org \
--cc=devicetree@vger.kernel.org \
--cc=dlechner@baylibre.com \
--cc=jic23@kernel.org \
--cc=krzk+dt@kernel.org \
--cc=krzk@kernel.org \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nuno.sa@analog.com \
--cc=robh@kernel.org \
--cc=yasin.lee.x@gmail.com \
--cc=yasin.lee.x@outlook.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox