Annotate the "configs" pointer field of "struct
tegra210_clk_emc_provider" with the "__counted_by_ptr" attribute,
allowing the compiler to perform runtime bounds checking on accesses to
"configs" based on the value of "num_configs".

The "emc->provider.configs = devm_kcalloc(...)" call uses
"emc->num_timings" for the number of elements, which is then assigned to
"emc->provider.num_configs" before any accesses to "configs". The
"num_configs" field isn't modified after assignment.

Cc: codemender-patching+linux@google.com
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
---
 include/linux/clk/tegra.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/clk/tegra.h b/include/linux/clk/tegra.h
index 3650e926e93f..f1034e14c1a4 100644
--- a/include/linux/clk/tegra.h
+++ b/include/linux/clk/tegra.h
@@ -170,7 +170,7 @@ struct tegra210_clk_emc_provider {
 	struct module *owner;
 	struct device *dev;
 
-	struct tegra210_clk_emc_config *configs;
+	struct tegra210_clk_emc_config *configs __counted_by_ptr(num_configs);
 	unsigned int num_configs;
 
 	int (*set_rate)(struct device *dev,
-- 
2.55.0.1082.g2b9226bbc0-goog

On Tue, Sep 22, 2026 at 11:06:01AM +0000, Bill Wendling wrote:
> Annotate the "configs" pointer field of "struct
> tegra210_clk_emc_provider" with the "__counted_by_ptr" attribute,
> allowing the compiler to perform runtime bounds checking on accesses to
> "configs" based on the value of "num_configs".
> 
> The "emc->provider.configs = devm_kcalloc(...)" call uses
> "emc->num_timings" for the number of elements, which is then assigned to
> "emc->provider.num_configs" before any accesses to "configs". The
> "num_configs" field isn't modified after assignment.

Yup, that's the only assignment I can find.

> Cc: codemender-patching+linux@google.com
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <morbo@google.com>

Reviewed-by: Kees Cook <kees@kernel.org>

-- 
Kees Cook

On 9/22/26 20:06, Bill Wendling wrote:
> Annotate the "configs" pointer field of "struct
> tegra210_clk_emc_provider" with the "__counted_by_ptr" attribute,
> allowing the compiler to perform runtime bounds checking on accesses to
> "configs" based on the value of "num_configs".
> 
> The "emc->provider.configs = devm_kcalloc(...)" call uses
> "emc->num_timings" for the number of elements, which is then assigned to
> "emc->provider.num_configs" before any accesses to "configs". The
> "num_configs" field isn't modified after assignment.
> 
> Cc: codemender-patching+linux@google.com
> Assisted-by: LLM
> Signed-off-by: Bill Wendling <morbo@google.com>

Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>

Thanks
-Gustavo

> ---
>   include/linux/clk/tegra.h | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/include/linux/clk/tegra.h b/include/linux/clk/tegra.h
> index 3650e926e93f..f1034e14c1a4 100644
> --- a/include/linux/clk/tegra.h
> +++ b/include/linux/clk/tegra.h
> @@ -170,7 +170,7 @@ struct tegra210_clk_emc_provider {
>   	struct module *owner;
>   	struct device *dev;
>   
> -	struct tegra210_clk_emc_config *configs;
> +	struct tegra210_clk_emc_config *configs __counted_by_ptr(num_configs);
>   	unsigned int num_configs;
>   
>   	int (*set_rate)(struct device *dev,