Re: [PATCH v3] leds: pwm: Annotate leds[] with __counted_by()

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The refactoring to use pointer arithmetic (led_data++) bypasses the newly added __counted_by() bounds checking.
--

--- Patch [1]: [PATCH v3] leds: pwm: Annotate leds[] with __counted_by() ---
commit c418c024dbd5055ff67d14fc9a244c4d09795169
Author: Mert Seftali <[email protected]>

leds: pwm: Annotate leds[] with __counted_by()

Adds the __counted_by() attribute to the flexible array member leds[] in
struct led_pwm_priv for bounds checking. To avoid UBSAN triggers during
initialization, the code is refactored to pass a led_pwm_data pointer into
led_pwm_add() instead of indexing the array directly.

> diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
> --- a/drivers/leds/leds-pwm.c
> +++ b/drivers/leds/leds-pwm.c
> @@ -81,10 +81,9 @@ static int led_pwm_default_brightness_get(struct fwnode_handle *fwnode,
>  }
>  
>  __attribute__((nonnull))
> -static int led_pwm_add(struct device *dev, struct led_pwm_priv *priv,
> +static int led_pwm_add(struct device *dev, struct led_pwm_data *led_data,
>  		       struct led_pwm *led, struct fwnode_handle *fwnode)
>  {
> -	struct led_pwm_data *led_data = &priv->leds[priv->num_leds];

[ ... ]

>  static int led_pwm_create_fwnode(struct device *dev, struct led_pwm_priv *priv)
>  {
> +	struct led_pwm_data *led_data = priv->leds;
>  	struct led_pwm led;
>  	int ret;
>  
> @@ -193,7 +192,7 @@ static int led_pwm_create_fwnode(struct device *dev, struct led_pwm_priv *priv)
>  
>  		led.default_state = led_init_default_state_get(fwnode);
>  
> -		ret = led_pwm_add(dev, priv, &led, fwnode);
> +		ret = led_pwm_add(dev, led_data++, &led, fwnode);

[Severity: Medium]
By decaying the flexible array to a pointer and using pointer arithmetic
(led_data++), doesn't the compiler lose the context needed to enforce the
__counted_by bounds check?

Compilers and sanitizers typically enforce __counted_by mitigations during
array subscripting operations like priv->leds[i]. Because priv->leds is
decayed into a standalone pointer and passed to led_pwm_add(), all bounds
information relative to priv->num_leds appears to be lost.

Will the primary objective of adding __counted_by be neutralized by passing
the element as a bare pointer here rather than using an index?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1