[PATCH] iio: adc: qcom-adc5-gen3: Annotate struct adc5_device_data with __counted_by_ptr

[PATCH] iio: adc: qcom-adc5-gen3: Annotate struct adc5_device_data with __counted_by_ptr

[Bill Wendling]

Under compiler-supported bounds checking (via KASAN or UBSAN), pointer
fields inside structures can be annotated with the '__counted_by_ptr'
attribute to specify which field in the same structure holds the element
count. This enables the compiler to perform runtime bounds checking on
the pointer.

Annotate the "base" pointer field in "struct adc5_device_data" with the
"__counted_by_ptr" attribute pointing to "num_sdams". The number of
SDAMs is determined from the device property and assigned to "num_sdams"
which is then used to initialize "base" via "devm_kcalloc".

By ensuring "num_sdams" is set to the correct element count prior to
the "base" pointer allocation, and since the size of "base" is never
reallocated or changed, this annotation is safe and will not cause any
false-positive runtime bounds check panics or KASAN issues.

Cc: codemender-patching+linux@google.com
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
---
 include/linux/iio/adc/qcom-adc5-gen3-common.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/iio/adc/qcom-adc5-gen3-common.h b/include/linux/iio/adc/qcom-adc5-gen3-common.h
index 39cbfcbdb101..b3e2c2f50e8f 100644
--- a/include/linux/iio/adc/qcom-adc5-gen3-common.h
+++ b/include/linux/iio/adc/qcom-adc5-gen3-common.h
@@ -137,7 +137,7 @@ struct adc5_sdam_data {
  */
 struct adc5_device_data {
 	struct regmap *regmap;
-	struct adc5_sdam_data *base;
+	struct adc5_sdam_data *base __counted_by_ptr(num_sdams);
 	int num_sdams;
 };
 
-- 
2.55.0.1082.g2b9226bbc0-goog

Re: [PATCH] iio: adc: qcom-adc5-gen3: Annotate struct adc5_device_data with __counted_by_ptr

[Gustavo A. R. Silva]

On 9/23/26 07:09, Bill Wendling wrote:
> Under compiler-supported bounds checking (via KASAN or UBSAN), pointer
> fields inside structures can be annotated with the '__counted_by_ptr'
> attribute to specify which field in the same structure holds the element
> count. This enables the compiler to perform runtime bounds checking on
> the pointer.
> 
> Annotate the "base" pointer field in "struct adc5_device_data" with the
> "__counted_by_ptr" attribute pointing to "num_sdams". The number of
> SDAMs is determined from the device property and assigned to "num_sdams"
> which is then used to initialize "base" via "devm_kcalloc".
> 
> By ensuring "num_sdams" is set to the correct element count prior to
> the "base" pointer allocation, and since the size of "base" is never
> reallocated or changed, this annotation is safe and will not cause any
> false-positive runtime bounds check panics or KASAN issues.
> 
> Cc: codemender-patching+linux@google.com
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <morbo@google.com>

Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>

Thanks
-Gustavo

> ---
>   include/linux/iio/adc/qcom-adc5-gen3-common.h | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/include/linux/iio/adc/qcom-adc5-gen3-common.h b/include/linux/iio/adc/qcom-adc5-gen3-common.h
> index 39cbfcbdb101..b3e2c2f50e8f 100644
> --- a/include/linux/iio/adc/qcom-adc5-gen3-common.h
> +++ b/include/linux/iio/adc/qcom-adc5-gen3-common.h
> @@ -137,7 +137,7 @@ struct adc5_sdam_data {
>    */
>   struct adc5_device_data {
>   	struct regmap *regmap;
> -	struct adc5_sdam_data *base;
> +	struct adc5_sdam_data *base __counted_by_ptr(num_sdams);
>   	int num_sdams;
>   };
>   

Re: [PATCH] iio: adc: qcom-adc5-gen3: Annotate struct adc5_device_data with __counted_by_ptr

[Daniel Lezcano]

On 9/23/26 00:09, Bill Wendling wrote:
> Under compiler-supported bounds checking (via KASAN or UBSAN), pointer
> fields inside structures can be annotated with the '__counted_by_ptr'
> attribute to specify which field in the same structure holds the element
> count. This enables the compiler to perform runtime bounds checking on
> the pointer.
> 
> Annotate the "base" pointer field in "struct adc5_device_data" with the
> "__counted_by_ptr" attribute pointing to "num_sdams". The number of
> SDAMs is determined from the device property and assigned to "num_sdams"
> which is then used to initialize "base" via "devm_kcalloc".
> 
> By ensuring "num_sdams" is set to the correct element count prior to
> the "base" pointer allocation, and since the size of "base" is never
> reallocated or changed, this annotation is safe and will not cause any
> false-positive runtime bounds check panics or KASAN issues.
> 
> Cc: codemender-patching+linux@google.com
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <morbo@google.com>
> ---

Acked-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com>

Re: [PATCH] iio: adc: qcom-adc5-gen3: Annotate struct adc5_device_data with __counted_by_ptr

[Kees Cook]

On Tue, Sep 22, 2026 at 10:09:50PM +0000, Bill Wendling wrote:
> Under compiler-supported bounds checking (via KASAN or UBSAN), pointer
> fields inside structures can be annotated with the '__counted_by_ptr'
> attribute to specify which field in the same structure holds the element
> count. This enables the compiler to perform runtime bounds checking on
> the pointer.
> 
> Annotate the "base" pointer field in "struct adc5_device_data" with the
> "__counted_by_ptr" attribute pointing to "num_sdams". The number of
> SDAMs is determined from the device property and assigned to "num_sdams"
> which is then used to initialize "base" via "devm_kcalloc".
> 
> By ensuring "num_sdams" is set to the correct element count prior to
> the "base" pointer allocation, and since the size of "base" is never
> reallocated or changed, this annotation is safe and will not cause any
> false-positive runtime bounds check panics or KASAN issues.

Welp, yes, it's allocated correctly to the size. It'll be interesting to
see if this:

        ret = device_property_count_u32(dev, "reg");
        if (ret < 0)
                return ret;

        adc->dev_data.num_sdams = ret;

is never at odds with this:

        ret = devm_request_threaded_irq(dev, adc->dev_data.base[ADC5_GEN3_VADC_SDAM].irq,
                                        NULL, adc5_gen3_isr, IRQF_ONESHOT | IRQF_SHARED,
                                        adc->dev_data.base[ADC5_GEN3_VADC_SDAM].irq_name,
                                        adc);

Nothing checks that num_sdams >= ADC5_GEN3_VADC_SDAM (0). I feel like
that ret = device_property_count_u32 should check for < 1 :)


-- 
Kees Cook

Re: [PATCH] iio: adc: qcom-adc5-gen3: Annotate struct adc5_device_data with __counted_by_ptr

[Jonathan Cameron]

On Wed, 23 Sep 2026 01:01:42 -0700
Kees Cook <kees@kernel.org> wrote:

> On Tue, Sep 22, 2026 at 10:09:50PM +0000, Bill Wendling wrote:
> > Under compiler-supported bounds checking (via KASAN or UBSAN), pointer
> > fields inside structures can be annotated with the '__counted_by_ptr'
> > attribute to specify which field in the same structure holds the element
> > count. This enables the compiler to perform runtime bounds checking on
> > the pointer.
> > 
> > Annotate the "base" pointer field in "struct adc5_device_data" with the
> > "__counted_by_ptr" attribute pointing to "num_sdams". The number of
> > SDAMs is determined from the device property and assigned to "num_sdams"
> > which is then used to initialize "base" via "devm_kcalloc".
> > 
> > By ensuring "num_sdams" is set to the correct element count prior to
> > the "base" pointer allocation, and since the size of "base" is never
> > reallocated or changed, this annotation is safe and will not cause any
> > false-positive runtime bounds check panics or KASAN issues.  
> 
> Welp, yes, it's allocated correctly to the size. It'll be interesting to
> see if this:
> 
>         ret = device_property_count_u32(dev, "reg");
>         if (ret < 0)
>                 return ret;
> 
>         adc->dev_data.num_sdams = ret;
> 
> is never at odds with this:
> 
>         ret = devm_request_threaded_irq(dev, adc->dev_data.base[ADC5_GEN3_VADC_SDAM].irq,
>                                         NULL, adc5_gen3_isr, IRQF_ONESHOT | IRQF_SHARED,
>                                         adc->dev_data.base[ADC5_GEN3_VADC_SDAM].irq_name,
>                                         adc);
> 
> Nothing checks that num_sdams >= ADC5_GEN3_VADC_SDAM (0). I feel like
> that ret = device_property_count_u32 should check for < 1 :)

Whilst it's sensible to sanity check dt, I'm not sure we will ever
close down all the crazy ways an invalid dt can break things!

I'd certainly be fine with some additional hardening of this particular
case though.

Applied this one as any such change is a different issue anyway

Thanks,

Jonathan

> 
>