Skip to contentSkip to conversation

um: add uml_kmalloc_array() helper to avoid potential

PATCH In review [email protected] 2 participants 3 messages Jan 20 – Jul 22 User-mode Linux (UML)

lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/2 um: add uml_kmalloc_array() helper to avoid potential

From: Haisu Wang <[email protected]>

Add uml_kmalloc_array to avoid potential dynamic multiplication overflow. Since in Documentation/process/deprecated.rst, the preferred way is avoid the open-coded arithmetic.

Signed-off-by Haisu Wang <[email protected]>
---
 arch/um/include/shared/um_malloc.h | 1 +
 arch/um/kernel/mem.c               | 5 +++++
 2 files changed, 6 insertions(+)
arch/um/include/shared/um_malloc.h +1 -0
index 815dd03e8707..a55a81131e10 100644
@@ -9,6 +9,7 @@
 #include <generated/asm-offsets.h>
 
 extern void *uml_kmalloc(int size, int flags);
+extern void *uml_kmalloc_array(int count, int size, int flags);
 extern void kfree(const void *ptr);
 
 extern void *vmalloc_noprof(unsigned long size);
arch/um/kernel/mem.c +5 -0
index 39c4a7e21c6f..3bf9e9bef3bf 100644
@@ -126,6 +126,11 @@ void *uml_kmalloc(int size, int flags)
 	return kmalloc(size, flags);
 }
 
+void *uml_kmalloc_array(int count, int size, int flags)
+{
+	return kmalloc_array(count, size, flags);
+}
+
 static const pgprot_t protection_map[16] = {
 	[VM_NONE]					= PAGE_NONE,
 	[VM_READ]					= PAGE_READONLY,
Signature · 1 line
2.52.0
author
#1 lore raw

PATCH 2/2 um: use uml_kmalloc_array() instead of uml_malloc()

From: Haisu Wang <[email protected]>

Replace uml_kmalloc() with uml_kmalloc_array() for multiplication.

Signed-off-by Haisu Wang <[email protected]>
---
 arch/um/drivers/vector_user.c | 4 ++--
 arch/um/drivers/vfio_user.c   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)
arch/um/drivers/vector_user.c +2 -2
index 2ea67e6fd067..adc4280691cf 100644
@@ -868,8 +868,8 @@ void *uml_vector_default_bpf(const void *mac)
 	} else {
 		return NULL;
 	}
-	bpf = uml_kmalloc(
-		sizeof(struct sock_filter) * DEFAULT_BPF_LEN, UM_GFP_KERNEL);
+	bpf = uml_kmalloc_array(DEFAULT_BPF_LEN, sizeof(struct sock_filter),
+			UM_GFP_KERNEL);
 	if (bpf) {
 		bpf_prog->filter = bpf;
 		/* ld	[8] */
arch/um/drivers/vfio_user.c +2 -2
index 6a45d8e14582..4ad8c8c59e9d 100644
@@ -194,7 +194,7 @@ int uml_vfio_user_setup_device(struct uml_vfio_user_device *dev,
 	if (dev->num_regions > VFIO_PCI_CONFIG_REGION_INDEX + 1)
 		dev->num_regions = VFIO_PCI_CONFIG_REGION_INDEX + 1;
 
-	dev->region = uml_kmalloc(sizeof(*dev->region) * dev->num_regions,
+	dev->region = uml_kmalloc_array(dev->num_regions, sizeof(*dev->region),
 				  UM_GFP_KERNEL);
 	if (!dev->region) {
 		err = -ENOMEM;

@@ -223,7 +223,7 @@ int uml_vfio_user_setup_device(struct uml_vfio_user_device *dev,
 
 	dev->irq_count = irq_info.count;
 
-	dev->irqfd = uml_kmalloc(sizeof(int) * dev->irq_count, UM_GFP_KERNEL);
+	dev->irqfd = uml_kmalloc_array(dev->irq_count, sizeof(int), UM_GFP_KERNEL);
 	if (!dev->irqfd) {
 		err = -ENOMEM;
 		goto free_region;
Signature · 1 line
2.52.0
maintainer
#2 lore raw
In reply to [email protected]
Quoted 5 lines · On Tue, 2026-01-20 at 19:28 +0800, [email protected] wrote:

From: Haisu Wang <[email protected]>

Add uml_kmalloc_array to avoid potential dynamic multiplication overflow. Since in Documentation/process/deprecated.rst, the preferred way is avoid the open-coded arithmetic.

Personally, I think it's kind of pointless because the only two users have small static arguments ... but if you want to continue with this then

Quoted 2 lines

+extern void *uml_kmalloc_array(int count, int size, int flags);

the prototype should probably match better and use size_t, size_t, unsigned int?

johannes