Skip to contentSkip to conversation

vhost: vringh: Use matching allocation type in resize_iovec()

PATCH In review Kees Cook 3 participants 3 messages Apr 26, 2025 – Apr 30, 2025

Subsystems (5)
Networking Network drivers KVM virtio core +1 more subsystems
lore
Share & tools
lore

Kees Cook

author
#0 lore raw

PATCH 1/1 vhost: vringh: Use matching allocation type in resize_iovec()

In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.)

The assigned type is "struct kvec *", but the returned type will be "struct iovec *". These have the same allocation size, so there is no bug:

struct kvec {
void *iov_base; /* and that should *never* hold a userland pointer */ size_t iov_len;
};

struct iovec

{
        void __user *iov_base;  /* BSD uses caddr_t (1003.1g requires void *) */
        __kernel_size_t iov_len; /* Must be size_t (1003.1g) */
};

Adjust the allocation type to match the assignment.

Signed-off-by Kees Cook <[email protected]>

---
Cc: "Michael S. Tsirkin" <[email protected]>
Cc: Jason Wang <[email protected]>
Cc: "Eugenio Pérez" <[email protected]>
Cc: <[email protected]>
Cc: <[email protected]>
Cc: <[email protected]>

---
 drivers/vhost/vringh.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/vhost/vringh.c +2 -3
index 73e153f9b449..93735fc5c5b4 100644
@@ -225,10 +225,9 @@ static int resize_iovec(struct vringh_kiov *iov, gfp_t gfp)
 
 	flag = (iov->max_num & VRINGH_IOV_ALLOCATED);
 	if (flag)
-		new = krealloc_array(iov->iov, new_num,
-				     sizeof(struct iovec), gfp);
+		new = krealloc_array(iov->iov, new_num, sizeof(*new), gfp);
 	else {
-		new = kmalloc_array(new_num, sizeof(struct iovec), gfp);
+		new = kmalloc_array(new_num, sizeof(*new), gfp);
 		if (new) {
 			memcpy(new, iov->iov,
 			       iov->max_num * sizeof(struct iovec));
Signature · 1 line
2.34.1
Acked-by on v1 1/1
#1 lore raw
Quoted 16 lines · Kees Cook

In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.)

The assigned type is "struct kvec *", but the returned type will be "struct iovec *". These have the same allocation size, so there is no bug:

struct kvec {
void *iov_base; /* and that should *never* hold a userland pointer */ size_t iov_len;
};

struct iovec

Quoted 8 lines
{
        void __user *iov_base;  /* BSD uses caddr_t (1003.1g requires void *) */
        __kernel_size_t iov_len; /* Must be size_t (1003.1g) */
};

Adjust the allocation type to match the assignment.

Signed-off-by Kees Cook <[email protected]>
Acked-by Jason Wang <[email protected]>

Thanks

Reviewed-by on v1 1/1
#2 lore raw
In reply to Kees Cook
Quoted 20 lines · Kees Cook

In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.)

The assigned type is "struct kvec *", but the returned type will be "struct iovec *". These have the same allocation size, so there is no bug:

struct kvec {
void *iov_base; /* and that should *never* hold a userland pointer */ size_t iov_len;
};

struct iovec

{
        void __user *iov_base;  /* BSD uses caddr_t (1003.1g requires void *) */
        __kernel_size_t iov_len; /* Must be size_t (1003.1g) */
};
Quoted 4 lines

Adjust the allocation type to match the assignment.

Signed-off-by Kees Cook <[email protected]>

---

Reviewed-by Jacob Keller <[email protected]>