[PATCH] rds: use krealloc_array() for iovector growth

[PATCH] rds: use krealloc_array() for iovector growth

[Weimin Xiong]

Use krealloc_array() for growing the RDS iovector array. This makes the
array allocation overflow-safe and derives the element size from the
array pointer.

Signed-off-by: Weimin Xiong <xiongwm2026@163.com>
---
diff --git a/net/rds/send.c b/net/rds/send.c
index 68be1bf0e..6a567c97a 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -971,11 +971,8 @@ static int rds_rm_size(struct msghdr *msg, int num_sgs,
 				return -EINVAL;
 			if (vct->indx >= vct->len) {
 				vct->len += vct->incr;
-				tmp_iov =
-					krealloc(vct->vec,
-						 vct->len *
-						 sizeof(struct rds_iov_vector),
-						 GFP_KERNEL);
+				tmp_iov = krealloc_array(vct->vec, vct->len,
+							 sizeof(*vct->vec), GFP_KERNEL);
 				if (!tmp_iov) {
 					vct->len -= vct->incr;
 					return -ENOMEM;

Re: [PATCH] rds: use krealloc_array() for iovector growth

[Allison Henderson]

On Thu, 2026-07-16 at 10:51 +0800, Weimin Xiong wrote:
> Use krealloc_array() for growing the RDS iovector array. This makes the
> array allocation overflow-safe and derives the element size from the
> array pointer.
> 
> Signed-off-by: Weimin Xiong <xiongwm2026@163.com>

Hi Weinmin,

Thanks for working on this.  This looks mostly good to me, the conversion
looks correct.  Just one nit, since this is a hardening fix
and not a bug fix, it should target the net-next branch in the subject
line like this:

[PATCH net-next v2] net/rds: use krealloc_array() for iovector growth

With that fixed, you can add my rvb:
Reviewed-by: Allison Henderson <achender@kernel.org>

Thanks!
Allison

> ---
> diff --git a/net/rds/send.c b/net/rds/send.c
> index 68be1bf0e..6a567c97a 100644
> --- a/net/rds/send.c
> +++ b/net/rds/send.c
> @@ -971,11 +971,8 @@ static int rds_rm_size(struct msghdr *msg, int num_sgs,
>  				return -EINVAL;
>  			if (vct->indx >= vct->len) {
>  				vct->len += vct->incr;
> -				tmp_iov =
> -					krealloc(vct->vec,
> -						 vct->len *
> -						 sizeof(struct rds_iov_vector),
> -						 GFP_KERNEL);
> +				tmp_iov = krealloc_array(vct->vec, vct->len,
> +							 sizeof(*vct->vec), GFP_KERNEL);
>  				if (!tmp_iov) {
>  					vct->len -= vct->incr;
>  					return -ENOMEM;
>