Commit 96a7b71c authored by Kees Cook's avatar Kees Cook
Browse files

ubd: Use pointer-to-pointers for io_thread_req arrays 



Having an unbounded array for irq_req_buffer and io_req_buffer doesn't
provide any bounds safety, and confuses the needed allocation type,
which is returning a pointer to pointers. Instead of the implicit cast,
switch the variable types.

Reported-by: default avatarNathan Chancellor <nathan@kernel.org>
Reported-by: default avatarGuenter Roeck <linux@roeck-us.net>
Closes: https://lore.kernel.org/all/b04b6c13-7d0e-4a89-9e68-b572b6c686ac@roeck-us.net


Fixes: 69050f8d ("treewide: Replace kmalloc with kmalloc_obj for non-scalar types")
Acked-by: default avatarRichard Weinberger <richard@nod.at>
Link: https://patch.msgid.link/20260223214341.work.846-kees@kernel.org


Signed-off-by: default avatarKees Cook <kees@kernel.org>
parent 6de23f81

arch/um/drivers/ubd_kern.c

+5 −5
Original line number Diff line number Diff line
@@ -69,11 +69,11 @@ struct io_thread_req { 
};





static struct io_thread_req * (*irq_req_buffer)[];

static struct io_thread_req **irq_req_buffer;

static struct io_thread_req *irq_remainder;

static int irq_remainder_size;



static struct io_thread_req * (*io_req_buffer)[];

static struct io_thread_req **io_req_buffer;

static struct io_thread_req *io_remainder;

static int io_remainder_size;
@@ -398,7 +398,7 @@ static int thread_fd = -1; 


static int bulk_req_safe_read(

	int fd,

	struct io_thread_req * (*request_buffer)[],

	struct io_thread_req **request_buffer,

	struct io_thread_req **remainder,

	int *remainder_size,

	int max_recs
@@ -465,7 +465,7 @@ static irqreturn_t ubd_intr(int irq, void *dev) 
			&irq_remainder, &irq_remainder_size,

			UBD_REQ_BUFFER_SIZE)) >= 0) {

		for (i = 0; i < len / sizeof(struct io_thread_req *); i++)

			ubd_end_request((*irq_req_buffer)[i]);

			ubd_end_request(irq_req_buffer[i]);

	}



	if (len < 0 && len != -EAGAIN)
@@ -1512,7 +1512,7 @@ void *io_thread(void *arg) 
		}



		for (count = 0; count < n/sizeof(struct io_thread_req *); count++) {

			struct io_thread_req *req = (*io_req_buffer)[count];

			struct io_thread_req *req = io_req_buffer[count];

			int i;



			io_count++;