From a1eae4befca272c238b6e832bbf27f49a5e03825 Mon Sep 17 00:00:00 2001 From: Bill Wendling Date: Fri, 25 Sep 2026 21:09:12 +0000 Subject: [PATCH] firewire: core: add __counted_by_ptr to struct fw_packet In 'struct fw_packet', the 'payload' field points to a buffer of size 'payload_length' bytes. To enable compiler bounds checking (via KASAN and __builtin_dynamic_object_size), add the '__counted_by_ptr' attribute to the 'payload' pointer, associated with the 'payload_length' count. A thorough analysis of all allocation and initialization points for 'struct fw_packet' was conducted. The pointer and its length are assigned together. Because the count field is always correctly initialized before the pointer is accessed, the '__counted_by_ptr' attribute is fully safe and will not cause runtime false positives or panics. Cc: codemender-patching+linux@google.com Assisted-by: LLM Signed-off-by: Bill Wendling Link: https://lore.kernel.org/r/20260925210912.113052-1-morbo@google.com Signed-off-by: Takashi Sakamoto --- include/linux/firewire.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/firewire.h b/include/linux/firewire.h index 91a89e812832..9d5a42724f1a 100644 --- a/include/linux/firewire.h +++ b/include/linux/firewire.h @@ -331,7 +331,7 @@ struct fw_packet { int generation; u32 header[4]; size_t header_length; - void *payload; + void *payload __counted_by_ptr(payload_length); size_t payload_length; dma_addr_t payload_bus; bool payload_mapped;