ubd: Use pointer-to-pointers for io_thread_req arrays

[PATCH] ubd: Use pointer-to-pointers for io_thread_req arrays

Posted by Kees Cook 1 month, 3 weeks ago

Having an unbounded array for irq_req_buffer and io_req_buffer doesn't
provide any bounds safety, and confuses the needed allocation type,
which is returning a pointer to pointers. Instead of the implicit cast,
switch the variable types.

Reported-by: Nathan Chancellor <nathan@kernel.org>
Reported-by: Guenter Roeck <linux@roeck-us.net>
Closes: https://lore.kernel.org/all/b04b6c13-7d0e-4a89-9e68-b572b6c686ac@roeck-us.net
Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types")
Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: Richard Weinberger <richard@nod.at>
Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Hannes Reinecke <hare@suse.de>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Tiwei Bie <tiwei.btw@antgroup.com>
Cc: <linux-um@lists.infradead.org>
---
 arch/um/drivers/ubd_kern.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 012b2bcaa8a0..20fc33300a95 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -69,11 +69,11 @@ struct io_thread_req {
 };
 
 
-static struct io_thread_req * (*irq_req_buffer)[];
+static struct io_thread_req **irq_req_buffer;
 static struct io_thread_req *irq_remainder;
 static int irq_remainder_size;
 
-static struct io_thread_req * (*io_req_buffer)[];
+static struct io_thread_req **io_req_buffer;
 static struct io_thread_req *io_remainder;
 static int io_remainder_size;
 
@@ -398,7 +398,7 @@ static int thread_fd = -1;
 
 static int bulk_req_safe_read(
 	int fd,
-	struct io_thread_req * (*request_buffer)[],
+	struct io_thread_req **request_buffer,
 	struct io_thread_req **remainder,
 	int *remainder_size,
 	int max_recs
@@ -465,7 +465,7 @@ static irqreturn_t ubd_intr(int irq, void *dev)
 			&irq_remainder, &irq_remainder_size,
 			UBD_REQ_BUFFER_SIZE)) >= 0) {
 		for (i = 0; i < len / sizeof(struct io_thread_req *); i++)
-			ubd_end_request((*irq_req_buffer)[i]);
+			ubd_end_request(irq_req_buffer[i]);
 	}
 
 	if (len < 0 && len != -EAGAIN)
@@ -1512,7 +1512,7 @@ void *io_thread(void *arg)
 		}
 
 		for (count = 0; count < n/sizeof(struct io_thread_req *); count++) {
-			struct io_thread_req *req = (*io_req_buffer)[count];
+			struct io_thread_req *req = io_req_buffer[count];
 			int i;
 
 			io_count++;
-- 
2.34.1

Re: [PATCH] ubd: Use pointer-to-pointers for io_thread_req arrays

Posted by Richard Weinberger 1 month, 3 weeks ago

----- Ursprüngliche Mail -----
> Von: "Kees Cook" <kees@kernel.org>
> An: "richard" <richard@nod.at>
> CC: "Kees Cook" <kees@kernel.org>, "Nathan Chancellor" <nathan@kernel.org>, "Guenter Roeck" <linux@roeck-us.net>, "anton
> ivanov" <anton.ivanov@cambridgegreys.com>, "Johannes Berg" <johannes@sipsolutions.net>, "Jens Axboe" <axboe@kernel.dk>,
> "Hannes Reinecke" <hare@suse.de>, "Martin K. Petersen" <martin.petersen@oracle.com>, "Tiwei Bie"
> <tiwei.btw@antgroup.com>, "linux-um" <linux-um@lists.infradead.org>, "Al Viro" <viro@zeniv.linux.org.uk>,
> "linux-kernel" <linux-kernel@vger.kernel.org>, "linux-hardening" <linux-hardening@vger.kernel.org>
> Gesendet: Montag, 23. Februar 2026 22:43:45
> Betreff: [PATCH] ubd: Use pointer-to-pointers for io_thread_req arrays

> Having an unbounded array for irq_req_buffer and io_req_buffer doesn't
> provide any bounds safety, and confuses the needed allocation type,
> which is returning a pointer to pointers. Instead of the implicit cast,
> switch the variable types.
> 
> Reported-by: Nathan Chancellor <nathan@kernel.org>
> Reported-by: Guenter Roeck <linux@roeck-us.net>
> Closes:
> https://lore.kernel.org/all/b04b6c13-7d0e-4a89-9e68-b572b6c686ac@roeck-us.net
> Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar
> types")
> Signed-off-by: Kees Cook <kees@kernel.org>
> ---
> Cc: Richard Weinberger <richard@nod.at>
> Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
> Cc: Johannes Berg <johannes@sipsolutions.net>
> Cc: Jens Axboe <axboe@kernel.dk>
> Cc: Hannes Reinecke <hare@suse.de>
> Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
> Cc: Tiwei Bie <tiwei.btw@antgroup.com>
> Cc: <linux-um@lists.infradead.org>
> ---
> arch/um/drivers/ubd_kern.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)

Acked-by: Richard Weinberger <richard@nod.at>

Thanks,
//richard