| Message ID | 20230817204215.never.916-kees@kernel.org (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | interconnect: qcom: Annotate struct icc_onecell_data with __counted_by | expand |
On 8/17/23 14:42, Kees Cook wrote: > Prepare for the coming implementation by GCC and Clang of the __counted_by > attribute. Flexible array members annotated with __counted_by can have > their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS > (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family > functions). > > As found with Coccinelle[1], add __counted_by for struct icc_onecell_data. > Additionally, since the element count member must be set before accessing > the annotated flexible array member, move its initialization earlier. > > [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci > > Cc: Andy Gross <agross@kernel.org> > Cc: Bjorn Andersson <andersson@kernel.org> > Cc: Konrad Dybcio <konrad.dybcio@linaro.org> > Cc: Georgi Djakov <djakov@kernel.org> > Cc: linux-arm-msm@vger.kernel.org > Cc: linux-pm@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Thanks
On 17.08.2023 22:42, Kees Cook wrote: > Prepare for the coming implementation by GCC and Clang of the __counted_by > attribute. Flexible array members annotated with __counted_by can have > their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS > (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family > functions). > > As found with Coccinelle[1], add __counted_by for struct icc_onecell_data. > Additionally, since the element count member must be set before accessing > the annotated flexible array member, move its initialization earlier. > > [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci > > Cc: Andy Gross <agross@kernel.org> > Cc: Bjorn Andersson <andersson@kernel.org> > Cc: Konrad Dybcio <konrad.dybcio@linaro.org> > Cc: Georgi Djakov <djakov@kernel.org> > Cc: linux-arm-msm@vger.kernel.org > Cc: linux-pm@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> > --- Very nice, thanks Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org> Konrad
diff --git a/drivers/interconnect/qcom/icc-rpmh.c b/drivers/interconnect/qcom/icc-rpmh.c index 8053ec8ab01b..b9f27ce3b607 100644 --- a/drivers/interconnect/qcom/icc-rpmh.c +++ b/drivers/interconnect/qcom/icc-rpmh.c @@ -185,6 +185,7 @@ int qcom_icc_rpmh_probe(struct platform_device *pdev) data = devm_kzalloc(dev, struct_size(data, nodes, num_nodes), GFP_KERNEL); if (!data) return -ENOMEM; + data->num_nodes = num_nodes; provider = &qp->provider; provider->dev = dev; @@ -228,8 +229,6 @@ int qcom_icc_rpmh_probe(struct platform_device *pdev) data->nodes[i] = node; } - data->num_nodes = num_nodes; - ret = icc_provider_register(provider); if (ret) goto err_remove_nodes; diff --git a/drivers/interconnect/qcom/msm8974.c b/drivers/interconnect/qcom/msm8974.c index b85cab2f208f..885ca9d6d4ed 100644 --- a/drivers/interconnect/qcom/msm8974.c +++ b/drivers/interconnect/qcom/msm8974.c @@ -675,6 +675,7 @@ static int msm8974_icc_probe(struct platform_device *pdev) GFP_KERNEL); if (!data) return -ENOMEM; + data->num_nodes = num_nodes; qp->bus_clks = devm_kmemdup(dev, msm8974_icc_bus_clocks, sizeof(msm8974_icc_bus_clocks), GFP_KERNEL); @@ -721,7 +722,6 @@ static int msm8974_icc_probe(struct platform_device *pdev) data->nodes[i] = node; } - data->num_nodes = num_nodes; ret = icc_provider_register(provider); if (ret) diff --git a/drivers/interconnect/qcom/osm-l3.c b/drivers/interconnect/qcom/osm-l3.c index 056ac91225c4..dc321bb86d0b 100644 --- a/drivers/interconnect/qcom/osm-l3.c +++ b/drivers/interconnect/qcom/osm-l3.c @@ -232,6 +232,7 @@ static int qcom_osm_l3_probe(struct platform_device *pdev) data = devm_kzalloc(&pdev->dev, struct_size(data, nodes, num_nodes), GFP_KERNEL); if (!data) return -ENOMEM; + data->num_nodes = num_nodes; provider = &qp->provider; provider->dev = &pdev->dev; @@ -261,7 +262,6 @@ static int qcom_osm_l3_probe(struct platform_device *pdev) data->nodes[i] = node; } - data->num_nodes = num_nodes; ret = icc_provider_register(provider); if (ret) diff --git a/include/linux/interconnect-provider.h b/include/linux/interconnect-provider.h index e6d8aca6886d..7ba183f221f1 100644 --- a/include/linux/interconnect-provider.h +++ b/include/linux/interconnect-provider.h @@ -33,7 +33,7 @@ struct icc_node_data { */ struct icc_onecell_data { unsigned int num_nodes; - struct icc_node *nodes[]; + struct icc_node *nodes[] __counted_by(num_nodes); }; struct icc_node *of_icc_xlate_onecell(struct of_phandle_args *spec,
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct icc_onecell_data. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Andy Gross <agross@kernel.org> Cc: Bjorn Andersson <andersson@kernel.org> Cc: Konrad Dybcio <konrad.dybcio@linaro.org> Cc: Georgi Djakov <djakov@kernel.org> Cc: linux-arm-msm@vger.kernel.org Cc: linux-pm@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- drivers/interconnect/qcom/icc-rpmh.c | 3 +-- drivers/interconnect/qcom/msm8974.c | 2 +- drivers/interconnect/qcom/osm-l3.c | 2 +- include/linux/interconnect-provider.h | 2 +- 4 files changed, 4 insertions(+), 5 deletions(-)