[PATCH] firewire: core: add __counted_by_ptr to struct fw_packet

[Bill Wendling]

In 'struct fw_packet', the 'payload' field points to a buffer of size
'payload_length' bytes. To enable compiler bounds checking (via KASAN
and __builtin_dynamic_object_size), add the '__counted_by_ptr' attribute
to the 'payload' pointer, associated with the 'payload_length' count.

A thorough analysis of all allocation and initialization points for
'struct fw_packet' was conducted. The pointer and its length are
assigned together.

Because the count field is always correctly initialized before the
pointer is accessed, the '__counted_by_ptr' attribute is fully safe and
will not cause runtime false positives or panics.

Cc: codemender-patching+linux@xxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@xxxxxxxxxx>
---
 include/linux/firewire.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/firewire.h b/include/linux/firewire.h
index fd35a6570cd8..9f313b47a694 100644
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -322,7 +322,7 @@ struct fw_packet {
 	int generation;
 	u32 header[4];
 	size_t header_length;
-	void *payload;
+	void *payload __counted_by_ptr(payload_length);
 	size_t payload_length;
 	dma_addr_t payload_bus;
 	bool payload_mapped;
-- 
2.56.0.rc1.315.gc6ed9934b7-goog