From: Kees Cook Date: Thu, 17 Aug 2023 21:15:28 +0000 (-0700) Subject: wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by X-Git-Tag: v6.6.17~4098^2~23^2~69 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e3eac9f32ec04112b39e01b574ac739382469bf9;p=platform%2Fkernel%2Flinux-rpi.git wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct cfg80211_scan_request. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Johannes Berg Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Reviewed-by: Jeff Johnson Link: https://lore.kernel.org/r/20230817211531.4193219-6-keescook@chromium.org Signed-off-by: Johannes Berg --- diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index 6efe216..a2afc94 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -2544,7 +2544,7 @@ struct cfg80211_scan_request { struct cfg80211_scan_6ghz_params *scan_6ghz_params; /* keep last */ - struct ieee80211_channel *channels[]; + struct ieee80211_channel *channels[] __counted_by(n_channels); }; static inline void get_random_mask_addr(u8 *buf, const u8 *addr, const u8 *mask)