Received-SPF: pass (google.com: domain of linux-wireless+bounces-7389-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID: <161df39ee89ae640828d3226a8de3d60f786ddd7.camel@sipsolutions.net>
Subject: Re: Fwd: UBSAN: array-index-out-of-bounds in net/wireless/nl80211.c
 and net/mac80211/scan.c
From: Johannes Berg <johannes@sipsolutions.net>
To: Jannik =?ISO-8859-1?Q?Gl=FCckert?= <jannik.glueckert@gmail.com>
Cc: Bagas Sanjaya <bagasdotme@gmail.com>, Linux Kernel Mailing List
 <linux-kernel@vger.kernel.org>, Linux Networking <netdev@vger.kernel.org>, 
 Linux Wireless <linux-wireless@vger.kernel.org>, Jouni Malinen
 <jouni.malinen@atheros.com>, "John W. Linville" <linville@tuxdriver.com>,
 Kalle Valo <kvalo@kernel.org>, Emmanuel Grumbach
 <emmanuel.grumbach@intel.com>, "David S. Miller" <davem@davemloft.net>,
 Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo
 Abeni <pabeni@redhat.com>,  Sam James <sam@gentoo.org>
Date: Thu, 09 May 2024 12:52:56 +0200
In-Reply-To: <CAFqe=z+bnNayKaxEnEFar28Q__yZ9Byaxe3YwtMaBEsASG2VwA@mail.gmail.com>
References: <ZjwTyGqcey0HXxTT@archie.me>
	 <12b6ac611c1a44b4eadbb1316636b7268ab66a50.camel@sipsolutions.net>
	 <CAFqe=z+bnNayKaxEnEFar28Q__yZ9Byaxe3YwtMaBEsASG2VwA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.50.4 (3.50.4-1.fc39) 
Precedence: bulk
MIME-Version: 1.0

On Thu, 2024-05-09 at 12:49 +0200, Jannik Gl=C3=BCckert wrote:
>=20
> > (Seriously. If you're running with bleeding edge toolchains that pretty
> > much nobody has yet, send patches.)
>=20
> I'm not sure what to make of this - this bug has been around ever
> since the code was added, modern toolchains just happen to be one way
> to expose it.

No, that's incorrect. This is perfectly valid code:

 struct x {
   int n;
   int a[] /* __counted_by(n) */;
 };

 x =3D alloc(sizeof(*x) + sizeof(int) * 2);
 x->a[0] =3D 10;
 x->a[1] =3D 20;
 x->n =3D 2;

However, the uncommenting of the __counted_by() annotation will lead to
a complaint.

johannes