On Tue, Feb 24, 2026 at 01:48:51PM -0800, Kees Cook wrote:
> On Tue, Feb 24, 2026 at 11:09:44AM +0100, Marco Elver wrote:
> > On Mon, 23 Feb 2026 at 23:22, Kees Cook <[email protected]> wrote:
> > >
> > > Instead of depending on the implicit case between a pointer to pointers
> > > and pointer to arrays, use the assigned variable type for the allocation
> > > type so they correctly match. Solves the following build error:
> > >
> > > ../kernel/kcsan/kcsan_test.c: In function '__report_matches':
> > > ../kernel/kcsan/kcsan_test.c:171:16: error: assignment to 'char (*)[512]'
> > > from incompatible pointer type 'char (*)[3][512]'
> > > [-Wincompatible-pointer-types]
> > > 171 | expect = kmalloc_obj(observed.lines);
> > > | ^
> > >
> > > Tested with:
> > >
> > > $ ./tools/testing/kunit/kunit.py run \
> > > --kconfig_add CONFIG_DEBUG_KERNEL=y \
> > > --kconfig_add CONFIG_KCSAN=y \
> > > --kconfig_add CONFIG_KCSAN_KUNIT_TEST=y \
> > > --arch=x86_64 --qemu_args '-smp 2' kcsan
> > >
> > > Reported-by: Nathan Chancellor <[email protected]>
> > > Fixes: 69050f8d6d07 ("treewide: Replace kmalloc with kmalloc_obj for
> > > non-scalar types")
> > > Signed-off-by: Kees Cook <[email protected]>
> > > ---
> > > Cc: Marco Elver <[email protected]>
> > > Cc: Dmitry Vyukov <[email protected]>
> > > Cc: <[email protected]>
> > > ---
> > > kernel/kcsan/kcsan_test.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/kernel/kcsan/kcsan_test.c b/kernel/kcsan/kcsan_test.c
> > > index 79e655ea4ca1..056fa859ad9a 100644
> > > --- a/kernel/kcsan/kcsan_test.c
> > > +++ b/kernel/kcsan/kcsan_test.c
> > > @@ -168,7 +168,7 @@ static bool __report_matches(const struct
> > > expect_report *r)
> > > if (!report_available())
> > > return false;
> > >
> > > - expect = kmalloc_obj(observed.lines);
> > > + expect = kmalloc_obj(*expect);
> >
> > This is wrong. Instead of allocating 3x512 bytes it's now only
> > allocating 512 bytes, so we get OOB below with this change. 'expect'
> > is a pointer to a 3-dimensional array of 512-char arrays (matching
> > observed.lines).
>
> Why did running the kunit test not trip over this? :(
>
> Hmpf, getting arrays allocated without an explicit cast seems to be
> impossible. How about this:
>
>
> diff --git a/kernel/kcsan/kcsan_test.c b/kernel/kcsan/kcsan_test.c
> index 056fa859ad9a..ae758150ccb9 100644
> --- a/kernel/kcsan/kcsan_test.c
> +++ b/kernel/kcsan/kcsan_test.c
> @@ -168,7 +168,7 @@ static bool __report_matches(const struct expect_report
> *r)
> if (!report_available())
> return false;
>
> - expect = kmalloc_obj(*expect);
> + expect = (typeof(expect))kmalloc_obj(observed.lines);
> if (WARN_ON(!expect))
> return false;
Or:
expect = kmalloc_objs(*observed.lines, ARRAY_SIZE(observed.lines));
I think the quoted cast is probably better...
--
Kees Cook
