From 8b101fb89074da2614d5f0cc834bf182ced899a4 Mon Sep 17 00:00:00 2001 From: Julian Schindel Date: Wed, 29 Apr 2026 21:55:06 +0200 Subject: [PATCH] vmm: replace `as ` casts with safer alternatives `as` casts can change mutability, which quickly leads to undefined behavior. Signed-off-by: Julian Schindel --- vmm/src/acpi.rs | 2 +- vmm/src/console_devices.rs | 4 ++-- vmm/src/cpu.rs | 5 +++-- vmm/src/device_manager.rs | 2 +- vmm/src/memory_manager.rs | 14 +++++++------- vmm/src/vm.rs | 2 +- 6 files changed, 15 insertions(+), 14 deletions(-) diff --git a/vmm/src/acpi.rs b/vmm/src/acpi.rs index ac05306bc..5809f5ead 100644 --- a/vmm/src/acpi.rs +++ b/vmm/src/acpi.rs @@ -1278,7 +1278,7 @@ mod tests { // safe to read. Casting to `u8` satisfies alignment requirements. let bytes = unsafe { std::slice::from_raw_parts( - &gi as *const GenericInitiatorAffinity as *const u8, + (&raw const gi).cast::(), std::mem::size_of::(), ) }; diff --git a/vmm/src/console_devices.rs b/vmm/src/console_devices.rs index 32cba7b78..1b21440a2 100644 --- a/vmm/src/console_devices.rs +++ b/vmm/src/console_devices.rs @@ -87,7 +87,7 @@ fn modify_mode( // and we check the return result. let mut termios: termios = unsafe { zeroed() }; // SAFETY: see above - let ret = unsafe { tcgetattr(fd, &mut termios as *mut _) }; + let ret = unsafe { tcgetattr(fd, &raw mut termios) }; if ret < 0 { return vmm_sys_util::errno::errno_result(); } @@ -98,7 +98,7 @@ fn modify_mode( f(&mut termios); // SAFETY: Safe because the syscall will only read the extent of termios and we check // the return result. - let ret = unsafe { tcsetattr(fd, TCSANOW, &termios as *const _) }; + let ret = unsafe { tcsetattr(fd, TCSANOW, &raw const termios) }; if ret < 0 { return vmm_sys_util::errno::errno_result(); } diff --git a/vmm/src/cpu.rs b/vmm/src/cpu.rs index ae7b44076..1f31ff61e 100644 --- a/vmm/src/cpu.rs +++ b/vmm/src/cpu.rs @@ -303,7 +303,7 @@ fn core_scheduling_cookie() -> u64 { PR_SCHED_CORE_GET, 0, PR_SCHED_CORE_SCOPE_THREAD, - &mut cookie as *mut u64, + &raw mut cookie, ) }; if ret == -1 { @@ -1187,12 +1187,13 @@ impl CpuManager { .spawn(move || { // Schedule the thread to run on the expected CPU set if let Some(cpuset) = cpuset.as_ref() { + let cpuset: *const libc::cpu_set_t = cpuset; // SAFETY: FFI call with correct arguments let ret = unsafe { libc::sched_setaffinity( 0, std::mem::size_of::(), - cpuset as *const libc::cpu_set_t, + cpuset, ) }; diff --git a/vmm/src/device_manager.rs b/vmm/src/device_manager.rs index 45dc9a2ef..ac85e1553 100644 --- a/vmm/src/device_manager.rs +++ b/vmm/src/device_manager.rs @@ -4902,7 +4902,7 @@ impl DeviceManager { .remove_userspace_mapping( mapping.addr.raw_value(), mapping.mapping.size(), - mapping.mapping.as_ptr() as _, + mapping.mapping.as_ptr().cast(), mapping.mergeable, mapping.mem_slot, ) diff --git a/vmm/src/memory_manager.rs b/vmm/src/memory_manager.rs index 870333a50..60885f2ce 100644 --- a/vmm/src/memory_manager.rs +++ b/vmm/src/memory_manager.rs @@ -1188,7 +1188,7 @@ impl MemoryManager { let n = unsafe { libc::read( uffd_raw_fd, - &mut msg as *mut uffd::UffdMsg as *mut libc::c_void, + (&raw mut msg).cast(), std::mem::size_of::(), ) }; @@ -1824,7 +1824,7 @@ impl MemoryManager { let res = unsafe { libc::syscall( libc::SYS_mbind, - addr as *mut libc::c_void, + addr.cast::(), len, mode, nodemask.as_ptr(), @@ -2002,7 +2002,7 @@ impl MemoryManager { // SAFETY: FFI call with correct arguments let ret = unsafe { let addr = r.as_ptr().add(offset); - libc::madvise(addr as _, pages * page_size, libc::MADV_POPULATE_WRITE) + libc::madvise(addr.cast(), pages * page_size, libc::MADV_POPULATE_WRITE) }; if ret != 0 { let e = io::Error::last_os_error(); @@ -2021,7 +2021,7 @@ impl MemoryManager { if thp && !hugepages { // SAFETY: FFI call with correct arguments - let ret = unsafe { libc::madvise(region.as_ptr() as _, size, libc::MADV_HUGEPAGE) }; + let ret = unsafe { libc::madvise(region.as_ptr().cast(), size, libc::MADV_HUGEPAGE) }; if ret != 0 { let e = io::Error::last_os_error(); warn!("Failed to mark pages as THP eligible: {e}"); @@ -2319,7 +2319,7 @@ impl MemoryManager { // mmap succeeded. let ret = unsafe { libc::madvise( - userspace_addr as *mut libc::c_void, + userspace_addr.cast(), memory_size as libc::size_t, libc::MADV_DONTDUMP, ) @@ -2335,7 +2335,7 @@ impl MemoryManager { // mmap succeeded. let ret = unsafe { libc::madvise( - userspace_addr as *mut libc::c_void, + userspace_addr.cast(), memory_size as libc::size_t, libc::MADV_MERGEABLE, ) @@ -2400,7 +2400,7 @@ impl MemoryManager { // previously advised. let ret = unsafe { libc::madvise( - userspace_addr as *mut libc::c_void, + userspace_addr.cast(), memory_size as libc::size_t, libc::MADV_UNMERGEABLE, ) diff --git a/vmm/src/vm.rs b/vmm/src/vm.rs index bd6c9bee4..1c3baf865 100644 --- a/vmm/src/vm.rs +++ b/vmm/src/vm.rs @@ -4069,7 +4069,7 @@ pub fn test_vm() { index as u32, region.start_addr().raw_value(), region.len().try_into().unwrap(), - region.as_ptr() as _, + region.as_ptr().cast(), false, false, )