From 4c16285dde76dc832aa6a426f1a76588a253e490 Mon Sep 17 00:00:00 2001 From: Oliver Anderson Date: Fri, 26 Sep 2025 12:29:43 +0200 Subject: [PATCH] vmm: Fix UB in AMX support checks Rust's aliasing rules do not permit mutating a `usize` through a shared reference. Unsafe blocks and FFI are no exception. This PR fixes such a violation detected in the AMX support checks by passing a raw mutable pointer instead of a shared reference in the syscall. Signed-off-by: Oliver Anderson On-behalf-of: SAP --- vmm/src/cpu.rs | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/vmm/src/cpu.rs b/vmm/src/cpu.rs index 3c54a7c4d..8eb552297 100644 --- a/vmm/src/cpu.rs +++ b/vmm/src/cpu.rs @@ -730,11 +730,16 @@ impl CpuManager { if amx_tile != 0 { return Err(Error::AmxEnable(anyhow!("Guest AMX usage not supported"))); } else { - let mask: usize = 0; - // SAFETY: the mask being modified (not marked mutable as it is - // modified in unsafe only which is permitted) isn't in use elsewhere. + let mut mask: usize = 0; + // SAFETY: Syscall with valid parameters. We use a raw mutable pointer to + // the `mask` place in order to ensure that we do not violate Rust's + // aliasing rules. let result = unsafe { - libc::syscall(libc::SYS_arch_prctl, ARCH_GET_XCOMP_GUEST_PERM, &mask) + libc::syscall( + libc::SYS_arch_prctl, + ARCH_GET_XCOMP_GUEST_PERM, + &raw mut mask, + ) }; if result != 0 || (mask & XFEATURE_XTILEDATA_MASK) != XFEATURE_XTILEDATA_MASK { return Err(Error::AmxEnable(anyhow!("Guest AMX usage not supported")));