| Message ID | 20240710230914.3156277-2-kees@kernel.org (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 32ef4b710cbe1a8901534033872a5bc6b1618bbc |
| Headers | show |
| Series | media: venus: hfi_cmds: struct hfi_session_release_buffer_pkt | expand |
On 10/07/24 17:09, Kees Cook wrote: > The only direct user of struct hfi_session_release_buffer_pkt is > pkt_session_unset_buffers() which sets "num_buffers" before using it > as a loop counter for accessing "buffer_info". Add the __counted_by > annotation to reflect the relationship. > > Signed-off-by: Kees Cook <kees@kernel.org> > --- > Cc: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> > Cc: Vikash Garodia <quic_vgarodia@quicinc.com> > Cc: "Bryan O'Donoghue" <bryan.odonoghue@linaro.org> > Cc: Mauro Carvalho Chehab <mchehab@kernel.org> > Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> > Cc: linux-media@vger.kernel.org > Cc: linux-arm-msm@vger.kernel.org > Cc: linux-hardening@vger.kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org> Thanks -- Gustavo > --- > drivers/media/platform/qcom/venus/hfi_cmds.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/media/platform/qcom/venus/hfi_cmds.h b/drivers/media/platform/qcom/venus/hfi_cmds.h > index 42825f07939d..1adf2d2ae5f2 100644 > --- a/drivers/media/platform/qcom/venus/hfi_cmds.h > +++ b/drivers/media/platform/qcom/venus/hfi_cmds.h > @@ -227,7 +227,7 @@ struct hfi_session_release_buffer_pkt { > u32 extradata_size; > u32 response_req; > u32 num_buffers; > - u32 buffer_info[]; > + u32 buffer_info[] __counted_by(num_buffers); > }; > > struct hfi_session_release_resources_pkt {
On 11/07/2024 00:09, Kees Cook wrote: > The only direct user of struct hfi_session_release_buffer_pkt is > pkt_session_unset_buffers() which sets "num_buffers" before using it > as a loop counter for accessing "buffer_info". Add the __counted_by > annotation to reflect the relationship. > > Signed-off-by: Kees Cook <kees@kernel.org> > --- > Cc: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> > Cc: Vikash Garodia <quic_vgarodia@quicinc.com> > Cc: "Bryan O'Donoghue" <bryan.odonoghue@linaro.org> > Cc: Mauro Carvalho Chehab <mchehab@kernel.org> > Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> > Cc: linux-media@vger.kernel.org > Cc: linux-arm-msm@vger.kernel.org > Cc: linux-hardening@vger.kernel.org > --- > drivers/media/platform/qcom/venus/hfi_cmds.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/media/platform/qcom/venus/hfi_cmds.h b/drivers/media/platform/qcom/venus/hfi_cmds.h > index 42825f07939d..1adf2d2ae5f2 100644 > --- a/drivers/media/platform/qcom/venus/hfi_cmds.h > +++ b/drivers/media/platform/qcom/venus/hfi_cmds.h > @@ -227,7 +227,7 @@ struct hfi_session_release_buffer_pkt { > u32 extradata_size; > u32 response_req; > u32 num_buffers; > - u32 buffer_info[]; > + u32 buffer_info[] __counted_by(num_buffers); > }; > > struct hfi_session_release_resources_pkt { Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
On 7/11/2024 4:39 AM, Kees Cook wrote: > The only direct user of struct hfi_session_release_buffer_pkt is > pkt_session_unset_buffers() which sets "num_buffers" before using it > as a loop counter for accessing "buffer_info". Add the __counted_by > annotation to reflect the relationship. > > Signed-off-by: Kees Cook <kees@kernel.org> > --- > Cc: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> > Cc: Vikash Garodia <quic_vgarodia@quicinc.com> > Cc: "Bryan O'Donoghue" <bryan.odonoghue@linaro.org> > Cc: Mauro Carvalho Chehab <mchehab@kernel.org> > Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> > Cc: linux-media@vger.kernel.org > Cc: linux-arm-msm@vger.kernel.org > Cc: linux-hardening@vger.kernel.org > --- > drivers/media/platform/qcom/venus/hfi_cmds.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/media/platform/qcom/venus/hfi_cmds.h b/drivers/media/platform/qcom/venus/hfi_cmds.h > index 42825f07939d..1adf2d2ae5f2 100644 > --- a/drivers/media/platform/qcom/venus/hfi_cmds.h > +++ b/drivers/media/platform/qcom/venus/hfi_cmds.h > @@ -227,7 +227,7 @@ struct hfi_session_release_buffer_pkt { > u32 extradata_size; > u32 response_req; > u32 num_buffers; > - u32 buffer_info[]; > + u32 buffer_info[] __counted_by(num_buffers); > }; > > struct hfi_session_release_resources_pkt { Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com> Regards, Vikash
On 7/11/2024 4:39 AM, Kees Cook wrote: > The only direct user of struct hfi_session_release_buffer_pkt is > pkt_session_unset_buffers() which sets "num_buffers" before using it > as a loop counter for accessing "buffer_info". Add the __counted_by > annotation to reflect the relationship. > > Signed-off-by: Kees Cook <kees@kernel.org> > --- > Cc: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> > Cc: Vikash Garodia <quic_vgarodia@quicinc.com> > Cc: "Bryan O'Donoghue" <bryan.odonoghue@linaro.org> > Cc: Mauro Carvalho Chehab <mchehab@kernel.org> > Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> > Cc: linux-media@vger.kernel.org > Cc: linux-arm-msm@vger.kernel.org > Cc: linux-hardening@vger.kernel.org > --- > drivers/media/platform/qcom/venus/hfi_cmds.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/media/platform/qcom/venus/hfi_cmds.h b/drivers/media/platform/qcom/venus/hfi_cmds.h > index 42825f07939d..1adf2d2ae5f2 100644 > --- a/drivers/media/platform/qcom/venus/hfi_cmds.h > +++ b/drivers/media/platform/qcom/venus/hfi_cmds.h > @@ -227,7 +227,7 @@ struct hfi_session_release_buffer_pkt { > u32 extradata_size; > u32 response_req; > u32 num_buffers; > - u32 buffer_info[]; > + u32 buffer_info[] __counted_by(num_buffers); > }; > > struct hfi_session_release_resources_pkt { Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com> Thanks, Dikshita
diff --git a/drivers/media/platform/qcom/venus/hfi_cmds.h b/drivers/media/platform/qcom/venus/hfi_cmds.h index 42825f07939d..1adf2d2ae5f2 100644 --- a/drivers/media/platform/qcom/venus/hfi_cmds.h +++ b/drivers/media/platform/qcom/venus/hfi_cmds.h @@ -227,7 +227,7 @@ struct hfi_session_release_buffer_pkt { u32 extradata_size; u32 response_req; u32 num_buffers; - u32 buffer_info[]; + u32 buffer_info[] __counted_by(num_buffers); }; struct hfi_session_release_resources_pkt {
The only direct user of struct hfi_session_release_buffer_pkt is pkt_session_unset_buffers() which sets "num_buffers" before using it as a loop counter for accessing "buffer_info". Add the __counted_by annotation to reflect the relationship. Signed-off-by: Kees Cook <kees@kernel.org> --- Cc: Stanimir Varbanov <stanimir.k.varbanov@gmail.com> Cc: Vikash Garodia <quic_vgarodia@quicinc.com> Cc: "Bryan O'Donoghue" <bryan.odonoghue@linaro.org> Cc: Mauro Carvalho Chehab <mchehab@kernel.org> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org> Cc: linux-media@vger.kernel.org Cc: linux-arm-msm@vger.kernel.org Cc: linux-hardening@vger.kernel.org --- drivers/media/platform/qcom/venus/hfi_cmds.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)