[PATCH] firewire: core: add __counted_by_ptr to struct fw_packet

[PATCH] firewire: core: add __counted_by_ptr to struct fw_packet

[Bill Wendling]

In 'struct fw_packet', the 'payload' field points to a buffer of size
'payload_length' bytes. To enable compiler bounds checking (via KASAN
and __builtin_dynamic_object_size), add the '__counted_by_ptr' attribute
to the 'payload' pointer, associated with the 'payload_length' count.

A thorough analysis of all allocation and initialization points for
'struct fw_packet' was conducted. The pointer and its length are
assigned together.

Because the count field is always correctly initialized before the
pointer is accessed, the '__counted_by_ptr' attribute is fully safe and
will not cause runtime false positives or panics.

Cc: codemender-patching+linux@google.com
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
---
 include/linux/firewire.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index fd35a6570cd8..9f313b47a694 100644
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -322,7 +322,7 @@ struct fw_packet {
 	int generation;
 	u32 header[4];
 	size_t header_length;
-	void *payload;
+	void *payload __counted_by_ptr(payload_length);
 	size_t payload_length;
 	dma_addr_t payload_bus;
 	bool payload_mapped;
-- 
2.56.0.rc1.315.gc6ed9934b7-goog

Re: [PATCH] firewire: core: add __counted_by_ptr to struct fw_packet

[Takashi Sakamoto]

On Fri, Sep 25, 2026 at 09:09:12PM +0000, Bill Wendling wrote:
> In 'struct fw_packet', the 'payload' field points to a buffer of size
> 'payload_length' bytes. To enable compiler bounds checking (via KASAN
> and __builtin_dynamic_object_size), add the '__counted_by_ptr' attribute
> to the 'payload' pointer, associated with the 'payload_length' count.
> 
> A thorough analysis of all allocation and initialization points for
> 'struct fw_packet' was conducted. The pointer and its length are
> assigned together.
> 
> Because the count field is always correctly initialized before the
> pointer is accessed, the '__counted_by_ptr' attribute is fully safe and
> will not cause runtime false positives or panics.
> 
> Cc: codemender-patching+linux@google.com
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <morbo@google.com>
> ---
>  include/linux/firewire.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Applied to for-next branch.


Thanks

Takashi Sakamoto