On 9/23/26 13:52, Bill Wendling wrote:
The GCC and Clang compilers support the "__counted_by_ptr" attribute on
pointer fields to associate them with an element count in the same
struct. This enables KASAN and UBSan bounds checking to detect
out-of-bounds accesses to the pointer.
In "include/linux/ieee80211-s1g.h", "struct s1g_tim_enc_block" has a
pointer member "ptr" of type "const u8 *" whose size is described by the
"len" member, which is correctly populated with the size of the buffer
before any pointer dereferences.
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Bill Wendling <[email protected]>
Reviewed-by: Gustavo A. R. Silva <[email protected]>
Thanks
-Gustavo
---
include/linux/ieee80211-s1g.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/ieee80211-s1g.h b/include/linux/ieee80211-s1g.h
index 3f9626ad3d97..8f6107782c38 100644
--- a/include/linux/ieee80211-s1g.h
+++ b/include/linux/ieee80211-s1g.h
@@ -349,7 +349,7 @@ struct s1g_tim_aid {
struct s1g_tim_enc_block {
u8 enc_mode;
bool inverse;
- const u8 *ptr;
+ const u8 *ptr __counted_by_ptr(len);
u8 len;
/*
