diff options
| author | Bill Wendling <morbo@google.com> | 2026-08-27 04:17:29 +0000 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-09-10 09:32:48 +0200 |
| commit | b4db97b9ef46909d6a8323d8cd04d81ef042e126 (patch) | |
| tree | 9ae75b97afb04b682ad2f04865fa32d292b75aeb | |
| parent | c966d29e01bbf829f8bb4a39a49811c56cdb49c3 (diff) | |
| download | linux-next-b4db97b9ef46909d6a8323d8cd04d81ef042e126.tar.gz linux-next-b4db97b9ef46909d6a8323d8cd04d81ef042e126.zip | |
vfs: Annotate struct fdtable's fd field with __counted_by_ptr
The 'struct fdtable' holds the file descriptor table information,
including the current file descriptor array 'fd' and its size 'max_fds'.
To harden the kernel against out-of-bounds accesses, we can annotate the
'fd' pointer field with the '__counted_by_ptr' attribute, referencing
'max_fds'.
The compiler uses the '__counted_by_ptr' attribute to track the
size of the memory allocated for the pointer field, enabling
runtime bounds checks under KASAN and fortified functions. There are
three places where a 'struct fdtable' is initialized, and in all of
them, 'max_fds' is set before the 'fd' pointer is accessed or assigned
in all allocation and initialization places.
No accesses to 'fd' occur before 'max_fds' is set, preventing any
potential runtime false-positives or panics due to uninitialized count
fields.
Signed-off-by: Bill Wendling <morbo@google.com>
Link: https://patch.msgid.link/20260827041732.188707-1-morbo@google.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
| -rw-r--r-- | include/linux/fdtable.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/include/linux/fdtable.h b/include/linux/fdtable.h index c45306a9f007..3a5c88291125 100644 --- a/include/linux/fdtable.h +++ b/include/linux/fdtable.h @@ -25,7 +25,7 @@ struct fdtable { unsigned int max_fds; - struct file __rcu **fd; /* current fd array */ + struct file __rcu **fd __counted_by_ptr(max_fds); /* current fd array */ unsigned long *close_on_exec; unsigned long *open_fds; unsigned long *full_fds_bits; |