On 2026/9/23 14:01, Bill Wendling wrote: > Annotate the 'qm_cap_table' and 'dev_cap_table' pointer fields in > 'struct hisi_qm_cap_tables' with the '__counted_by_ptr' attribute. > This improves bounds checking via CONFIG_UBSAN_BOUNDS and > CONFIG_FORTIFY_SOURCE, allowing KASAN and compiler diagnostics to > detect out-of-bounds accesses. > > The 'qm_cap_table' pointer is associated with 'qm_cap_size' which > specifies its element count. Similarly, 'dev_cap_table' is associated > with 'dev_cap_size'. > > To ensure safety under compiler instrumentation, the assignments in the > initialization paths have been updated to set the 'size'/'count' fields > prior to setting the pointer fields. This prevents any transient state > where the pointer is valid but the count is 0 (or uninitialized), > ensuring that subsequent accesses to these tables do not trigger > false-positive bounds check panics. > > Cc: [email protected] > Assisted-by: LLM > Signed-off-by: Bill Wendling <[email protected]> > --- > drivers/crypto/hisilicon/hpre/hpre_main.c | 2 +- > drivers/crypto/hisilicon/qm.c | 2 +- > drivers/crypto/hisilicon/sec2/sec_main.c | 2 +- > drivers/crypto/hisilicon/zip/zip_main.c | 2 +- > include/linux/hisi_acc_qm.h | 4 ++-- > 5 files changed, 6 insertions(+), 6 deletions(-) >
Reviewed-by: Longfang Liu <[email protected]> Thanks. Longfang. > diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c > b/drivers/crypto/hisilicon/hpre/hpre_main.c > index b6903fce6071..4a1b2de476f5 100644 > --- a/drivers/crypto/hisilicon/hpre/hpre_main.c > +++ b/drivers/crypto/hisilicon/hpre/hpre_main.c > @@ -1234,8 +1234,8 @@ static int hpre_pre_store_cap_reg(struct hisi_qm *qm) > return -EINVAL; > } > > - qm->cap_tables.dev_cap_table = hpre_cap; > qm->cap_tables.dev_cap_size = size; > + qm->cap_tables.dev_cap_table = hpre_cap; > > return 0; > } > diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c > index c01966a4a33f..7d13476451e3 100644 > --- a/drivers/crypto/hisilicon/qm.c > +++ b/drivers/crypto/hisilicon/qm.c > @@ -5743,8 +5743,8 @@ static int qm_pre_store_caps(struct hisi_qm *qm) > i, qm->cap_ver); > } > > - qm->cap_tables.qm_cap_table = qm_cap; > qm->cap_tables.qm_cap_size = size; > + qm->cap_tables.qm_cap_table = qm_cap; > > return 0; > } > diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c > b/drivers/crypto/hisilicon/sec2/sec_main.c > index 752565200c16..ac423d016998 100644 > --- a/drivers/crypto/hisilicon/sec2/sec_main.c > +++ b/drivers/crypto/hisilicon/sec2/sec_main.c > @@ -1285,8 +1285,8 @@ static int sec_pre_store_cap_reg(struct hisi_qm *qm) > i, qm->cap_ver); > } > > - qm->cap_tables.dev_cap_table = sec_cap; > qm->cap_tables.dev_cap_size = size; > + qm->cap_tables.dev_cap_table = sec_cap; > > return 0; > } > diff --git a/drivers/crypto/hisilicon/zip/zip_main.c > b/drivers/crypto/hisilicon/zip/zip_main.c > index 706a73656977..10091ad4a6a8 100644 > --- a/drivers/crypto/hisilicon/zip/zip_main.c > +++ b/drivers/crypto/hisilicon/zip/zip_main.c > @@ -1400,8 +1400,8 @@ static int zip_pre_store_cap_reg(struct hisi_qm *qm) > i, qm->cap_ver); > } > > - qm->cap_tables.dev_cap_table = zip_cap; > qm->cap_tables.dev_cap_size = size; > + qm->cap_tables.dev_cap_table = zip_cap; > > return 0; > } > diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h > index f7570a409905..8dc49fa2123b 100644 > --- a/include/linux/hisi_acc_qm.h > +++ b/include/linux/hisi_acc_qm.h > @@ -332,9 +332,9 @@ struct hisi_qm_cap_record { > > struct hisi_qm_cap_tables { > u32 qm_cap_size; > - struct hisi_qm_cap_record *qm_cap_table; > + struct hisi_qm_cap_record *qm_cap_table __counted_by_ptr(qm_cap_size); > u32 dev_cap_size; > - struct hisi_qm_cap_record *dev_cap_table; > + struct hisi_qm_cap_record *dev_cap_table __counted_by_ptr(dev_cap_size); > }; > > struct hisi_qm_list { >
