According to 'ath11k_reg_update_chan_list()', annotate flexible
array member 'ch_param' of 'struct scan_chan_list_params' with
'__counted_by()' attribute to improve runtime bounds checking
when CONFIG_UBSAN_BOUNDS is enabled. Compile tested only.
Signed-off-by: Dmitry Antipov <dmantipov@xxxxxxxxx>
---
v2: add related comment in ath11k_reg_update_chan_list()
---
drivers/net/wireless/ath/ath11k/reg.c | 3 +++
drivers/net/wireless/ath/ath11k/wmi.h | 2 +-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
index b0f289784dd3..0a8a0ea2bdc7 100644
--- a/drivers/net/wireless/ath/ath11k/reg.c
+++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -164,6 +164,9 @@ int ath11k_reg_update_chan_list(struct ath11k *ar, bool wait)
return -ENOMEM;
params->pdev_id = ar->pdev->pdev_id;
+ /* Note nallchans should be set before populating ch_param[],
+ * otherwise __counted_by() might raise false positives.
+ */
params->nallchans = num_channels;
ch = params->ch_param;
diff --git a/drivers/net/wireless/ath/ath11k/wmi.h b/drivers/net/wireless/ath/ath11k/wmi.h
index 8982b909c821..58471da42087 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.h
+++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -3819,7 +3819,7 @@ struct wmi_stop_scan_cmd {
struct scan_chan_list_params {
u32 pdev_id;
u16 nallchans;
- struct channel_param ch_param[];
+ struct channel_param ch_param[] __counted_by(nallchans);
};
struct wmi_scan_chan_list_cmd {
--
2.47.0
