Re: Fwd: UBSAN: array-index-out-of-bounds in net/wireless/nl80211.c and net/mac80211/scan.c

[Johannes Berg]

On Thu, 2024-05-09 at 12:49 +0200, Jannik Glückert wrote:
> 
> > (Seriously. If you're running with bleeding edge toolchains that pretty
> > much nobody has yet, send patches.)
> 
> I'm not sure what to make of this - this bug has been around ever
> since the code was added, modern toolchains just happen to be one way
> to expose it.

No, that's incorrect. This is perfectly valid code:

 struct x {
   int n;
   int a[] /* __counted_by(n) */;
 };

 x = alloc(sizeof(*x) + sizeof(int) * 2);
 x->a[0] = 10;
 x->a[1] = 20;
 x->n = 2;

However, the uncommenting of the __counted_by() annotation will lead to
a complaint.

johannes