[PATCH] ubd: Use pointer-to-pointers for io_thread_req arrays

[Richard Weinberger]

----- Ursprüngliche Mail -----
> Von: "Kees Cook" <kees at kernel.org>
> An: "richard" <richard at nod.at>
> CC: "Kees Cook" <kees at kernel.org>, "Nathan Chancellor" <nathan at kernel.org>, "Guenter Roeck" <linux at roeck-us.net>, "anton
> ivanov" <anton.ivanov at cambridgegreys.com>, "Johannes Berg" <johannes at sipsolutions.net>, "Jens Axboe" <axboe at kernel.dk>,
> "Hannes Reinecke" <hare at suse.de>, "Martin K. Petersen" <martin.petersen at oracle.com>, "Tiwei Bie"
> <tiwei.btw at antgroup.com>, "linux-um" <linux-um at lists.infradead.org>, "Al Viro" <viro at zeniv.linux.org.uk>,
> "linux-kernel" <linux-kernel at vger.kernel.org>, "linux-hardening" <linux-hardening at vger.kernel.org>
> Gesendet: Montag, 23. Februar 2026 22:43:45
> Betreff: [PATCH] ubd: Use pointer-to-pointers for io_thread_req arrays

> Having an unbounded array for irq_req_buffer and io_req_buffer doesn't
> provide any bounds safety, and confuses the needed allocation type,
> which is returning a pointer to pointers. Instead of the implicit cast,
> switch the variable types.
> 
> Reported-by: Nathan Chancellor <nathan at kernel.org>
> Reported-by: Guenter Roeck <linux at roeck-us.net>
> Closes:
> https://lore.kernel.org/all/b04b6c13-7d0e-4a89-9e68-b572b6c686ac@roeck-us.net
> Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for non-scalar
> types")
> Signed-off-by: Kees Cook <kees at kernel.org>
> ---
> Cc: Richard Weinberger <richard at nod.at>
> Cc: Anton Ivanov <anton.ivanov at cambridgegreys.com>
> Cc: Johannes Berg <johannes at sipsolutions.net>
> Cc: Jens Axboe <axboe at kernel.dk>
> Cc: Hannes Reinecke <hare at suse.de>
> Cc: "Martin K. Petersen" <martin.petersen at oracle.com>
> Cc: Tiwei Bie <tiwei.btw at antgroup.com>
> Cc: <linux-um at lists.infradead.org>
> ---
> arch/um/drivers/ubd_kern.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)

Acked-by: Richard Weinberger <richard at nod.at>

Thanks,
//richard