Commit 3d8cc52db2f8 for kernel

commit 3d8cc52db2f86b624308321c58513019f6b21eec
Author: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
Date:   Sat Oct 10 23:44:49 2026 +0700

    landlock: Drop __counted_by from landlock_domain.handled_masks

    With clang 22 and CONFIG_FORTIFY_SOURCE, the second
    landlock_restrict_self() call hits a bogus fortify report in
    inherit_ruleset():

      memcpy: detected buffer overflow: 4 byte write of buffer size 0
      Call Trace:
       __fortify_panic
       landlock_merge_ruleset
       __se_sys_landlock_restrict_self

    handled_masks[] lives in an anonymous struct inside the anonymous union
    that overlays work_free.  For such a flexible array, clang computes the
    address of the __counted_by counter as the start of the array instead of
    &num_layers.  The bound is then read from handled_masks[0], i.e. from
    the first layer's access masks, which is not a count.  The same layout
    crashes clang itself in a standalone test.

    The annotation was added as documentation, so drop it rather than
    restructure the union.  Keep the information in the member comment.

    Reported-by: syzbot+a0eecb22de4d821a9e5d@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=a0eecb22de4d821a9e5d
    Fixes: bd3a19800dd1 ("landlock: Add counted_by in landlock_domain")
    Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
    Link: https://lore.kernel.org/r/20261010164450.194439-1-ngocthang2710.1999@gmail.com
    Reviewed-by: Günther Noack <gnoack3000@gmail.com>
    Reported-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
    Reported-by: Mike Bommarito <michael.bommarito@gmail.com>
    Closes: https://lore.kernel.org/r/20261009115108.17819-1-michael.bommarito@gmail.com
    [mic: Rebased on master, where the array is handled_masks[], updated the
    fortify report, added the clang bug link and the other reports]
    Signed-off-by: Mickaël Salaün <mic@digikod.net>

diff --git a/security/landlock/domain.h b/security/landlock/domain.h
index caa3d19d2c43..428c1d9890db 100644
--- a/security/landlock/domain.h
+++ b/security/landlock/domain.h
@@ -242,9 +242,14 @@ struct landlock_domain {
 			 * to properly handle merged rulesets without
 			 * overlapping access rights.  These layers are set once
 			 * and never changed for the lifetime of the domain.
+			 *
+			 * Not annotated with __counted_by(num_layers): clang
+			 * miscomputes the counter address for a FAM nested in
+			 * an anonymous struct within a union, which trips
+			 * FORTIFY:
+			 * https://github.com/llvm/llvm-project/pull/228309
 			 */
-			struct access_masks
-				handled_masks[] __counted_by(num_layers);
+			struct access_masks handled_masks[];
 		};
 	};
 };