From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 26 Jul 2024 15:28:15 +0000 (+0200)
Subject: ALSA: control: Annotate snd_kcontrol with __counted_by()
X-Git-Tag: v6.12-rc1~169^2~148
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4e9652003bc39032c3ab79e607aa3d1913c7cf57;p=thirdparty%2Fkernel%2Flinux.git

ALSA: control: Annotate snd_kcontrol with __counted_by()

struct snd_kcontrol contains a flex array of snd_kcontrol_volatile
objects at its end, and the array size is stored in count field.
This can be annotated gracefully with __counted_by() for catching
possible array overflows.

One additional change is the order of the count field initialization;
The assignment of the count field is moved before assignment of vd[]
elements for avoiding false-positive warnings from compilers.

Link: https://patch.msgid.link/20240726152840.8629-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---

diff --git a/include/sound/control.h b/include/sound/control.h
index c1659036c4a77..13511c50825f6 100644
--- a/include/sound/control.h
+++ b/include/sound/control.h
@@ -81,7 +81,7 @@ struct snd_kcontrol {
 	unsigned long private_value;
 	void *private_data;
 	void (*private_free)(struct snd_kcontrol *kcontrol);
-	struct snd_kcontrol_volatile vd[];	/* volatile data */
+	struct snd_kcontrol_volatile vd[] __counted_by(count);	/* volatile data */
 };
 
 #define snd_kcontrol(n) list_entry(n, struct snd_kcontrol, list)
diff --git a/sound/core/control.c b/sound/core/control.c
index f64a555f404f0..c3aad64ffbf5b 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -237,11 +237,11 @@ static int snd_ctl_new(struct snd_kcontrol **kctl, unsigned int count,
 	if (!*kctl)
 		return -ENOMEM;
 
+	(*kctl)->count = count;
 	for (idx = 0; idx < count; idx++) {
 		(*kctl)->vd[idx].access = access;
 		(*kctl)->vd[idx].owner = file;
 	}
-	(*kctl)->count = count;
 
 	return 0;
 }