Re: [PATCH] rust: alloc: fix dangling pointer in VecExt<T>::reserve()

[Danilo Krummrich <dakr@redhat.com>]

On Tue, Apr 30, 2024 at 10:25:07AM +0200, Alice Ryhl wrote:
> On Mon, Apr 29, 2024 at 9:24 PM Danilo Krummrich <dakr@redhat.com> wrote:
> >
> > Currently, a Vec<T>'s ptr value, after calling Vec<T>::new(), is
> > initialized to Unique::dangling(). Hence, in VecExt<T>::reserve(), we're
> > passing a dangling pointer (instead of NULL) to krealloc() whenever a
> > new Vec<T> is created through VecExt<T> extension functions.
> 
> Good catch!
> 
> > This only works since it happens that Unique::dangling()'s value (0x1)
> > falls within the range between 0x0 and ZERO_SIZE_PTR (0x10) and
> > krealloc() hence treats it the same as a NULL pointer however.
> 
> This isn't quite true. The value of Unique::dangling() is actually
> align_of::<T>() rather than 0x1. So for types that have an alignment
> of 0x20 or greater, it would not work today.

Oh, indeed - gonna send a v2 fixing the commit message.

Thanks,
Danilo

> 
> > This isn't a case we should rely on, especially since other kernel
> > allocators are not as tolerant. Instead, pass a real NULL pointer to
> > krealloc_aligned() if Vec<T>'s capacity is zero.
> >
> > Fixes: 5ab560ce12ed ("rust: alloc: update `VecExt` to take allocation flags")
> > Signed-off-by: Danilo Krummrich <dakr@redhat.com>
> 
> Reviewed-by: Alice Ryhl <aliceryhl@google.com>
>