The GCC and Clang compilers support the "__counted_by_ptr" attribute on pointer fields to associate them with an element count in the same struct. This enables KASAN and UBSan bounds checking to detect out-of-bounds accesses to the pointer.
In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a pointer member "ptr" of type "const u8 *" whose size is described by the "len" member, which is correctly populated with the size of the buffer before any pointer dereferences. Cc: [email protected] Assisted-by: LLM Signed-off-by: Bill Wendling <[email protected]> --- include/linux/ieee80211-s1g.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/ieee80211-s1g.h b/include/linux/ieee80211-s1g.h index 3f9626ad3d97..8f6107782c38 100644 --- a/include/linux/ieee80211-s1g.h +++ b/include/linux/ieee80211-s1g.h @@ -349,7 +349,7 @@ struct s1g_tim_aid { struct s1g_tim_enc_block { u8 enc_mode; bool inverse; - const u8 *ptr; + const u8 *ptr __counted_by_ptr(len); u8 len; /* -- 2.55.0.1082.g2b9226bbc0-goog
