From 9b0d4b20ea8c2dc94044d813b73d796892711fad Mon Sep 17 00:00:00 2001 From: Julian Schindel Date: Wed, 29 Apr 2026 21:55:06 +0200 Subject: [PATCH] hypervisor: replace `as ` casts with safer alternatives `as` casts can change mutability, which quickly leads to undefined behavior. Signed-off-by: Julian Schindel --- hypervisor/src/kvm/aarch64/gic/dist_regs.rs | 6 +++--- hypervisor/src/kvm/aarch64/gic/icc_regs.rs | 4 ++-- hypervisor/src/kvm/aarch64/gic/mod.rs | 12 ++++++------ hypervisor/src/kvm/aarch64/gic/redist_regs.rs | 4 ++-- hypervisor/src/kvm/mod.rs | 18 ++++++++---------- hypervisor/src/kvm/riscv64/aia.rs | 12 ++++++------ hypervisor/src/kvm/x86_64/sev.rs | 8 ++++---- hypervisor/src/mshv/mod.rs | 2 +- 8 files changed, 32 insertions(+), 34 deletions(-) diff --git a/hypervisor/src/kvm/aarch64/gic/dist_regs.rs b/hypervisor/src/kvm/aarch64/gic/dist_regs.rs index 9a3c719e7..bfec2f8bf 100644 --- a/hypervisor/src/kvm/aarch64/gic/dist_regs.rs +++ b/hypervisor/src/kvm/aarch64/gic/dist_regs.rs @@ -82,7 +82,7 @@ fn dist_attr_set(gic: &DeviceFd, offset: u32, val: u32) -> Result<()> { let gic_dist_attr = kvm_device_attr { group: KVM_DEV_ARM_VGIC_GRP_DIST_REGS, attr: offset as u64, - addr: &val as *const u32 as u64, + addr: &raw const val as u64, flags: 0, }; @@ -99,7 +99,7 @@ fn dist_attr_get(gic: &DeviceFd, offset: u32) -> Result { let mut gic_dist_attr = kvm_device_attr { group: KVM_DEV_ARM_VGIC_GRP_DIST_REGS, attr: offset as u64, - addr: &mut val as *mut u32 as u64, + addr: &raw mut val as u64, flags: 0, }; @@ -127,7 +127,7 @@ fn get_interrupts_num(gic: &DeviceFd) -> Result { let mut nr_irqs_attr = kvm_device_attr { group: KVM_DEV_ARM_VGIC_GRP_NR_IRQS, attr: 0, - addr: &mut num_irq as *mut u32 as u64, + addr: &raw mut num_irq as u64, flags: 0, }; // SAFETY: nr_irqs_attr.addr is safe to write to. diff --git a/hypervisor/src/kvm/aarch64/gic/icc_regs.rs b/hypervisor/src/kvm/aarch64/gic/icc_regs.rs index b084c8989..681754dc4 100644 --- a/hypervisor/src/kvm/aarch64/gic/icc_regs.rs +++ b/hypervisor/src/kvm/aarch64/gic/icc_regs.rs @@ -85,7 +85,7 @@ fn icc_attr_set(gic: &DeviceFd, offset: u64, typer: u64, val: u32) -> Result<()> let gic_icc_attr = kvm_device_attr { group: KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS, attr: ((typer & KVM_DEV_ARM_VGIC_V3_MPIDR_MASK) | offset), // this needs the mpidr - addr: &val as *const u32 as u64, + addr: &raw const val as u64, flags: 0, }; @@ -102,7 +102,7 @@ fn icc_attr_get(gic: &DeviceFd, offset: u64, typer: u64) -> Result { let mut gic_icc_attr = kvm_device_attr { group: KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS, attr: ((typer & KVM_DEV_ARM_VGIC_V3_MPIDR_MASK) | offset), // this needs the mpidr - addr: &mut val as *mut u32 as u64, + addr: &raw mut val as u64, flags: 0, }; diff --git a/hypervisor/src/kvm/aarch64/gic/mod.rs b/hypervisor/src/kvm/aarch64/gic/mod.rs index 8dcf06078..1e25a69e7 100644 --- a/hypervisor/src/kvm/aarch64/gic/mod.rs +++ b/hypervisor/src/kvm/aarch64/gic/mod.rs @@ -30,7 +30,7 @@ fn gicv3_its_attr_set(its_device: &DeviceFd, group: u32, attr: u32, val: u64) -> let gicv3_its_attr = kvm_bindings::kvm_device_attr { group, attr: attr as u64, - addr: &val as *const u64 as u64, + addr: &raw const val as u64, flags: 0, }; @@ -45,7 +45,7 @@ fn gicv3_its_attr_get(its_device: &DeviceFd, group: u32, attr: u32) -> Result Result< let gic_redist_attr = kvm_device_attr { group: KVM_DEV_ARM_VGIC_GRP_REDIST_REGS, attr: (typer & KVM_DEV_ARM_VGIC_V3_MPIDR_MASK) | (offset as u64), // this needs the mpidr - addr: &val as *const u32 as u64, + addr: &raw const val as u64, flags: 0, }; @@ -117,7 +117,7 @@ fn redist_attr_get(gic: &DeviceFd, offset: u32, typer: u64) -> Result { let mut gic_redist_attr = kvm_device_attr { group: KVM_DEV_ARM_VGIC_GRP_REDIST_REGS, attr: (typer & KVM_DEV_ARM_VGIC_V3_MPIDR_MASK) | (offset as u64), // this needs the mpidr - addr: &mut val as *mut u32 as u64, + addr: &raw mut val as u64, flags: 0, }; diff --git a/hypervisor/src/kvm/mod.rs b/hypervisor/src/kvm/mod.rs index c127a1549..24e3cdbd7 100644 --- a/hypervisor/src/kvm/mod.rs +++ b/hypervisor/src/kvm/mod.rs @@ -121,7 +121,7 @@ use kvm_bindings::{ #[cfg(target_arch = "riscv64")] use kvm_bindings::{KVM_REG_RISCV_CORE, kvm_riscv_core}; #[cfg(feature = "tdx")] -use kvm_bindings::{KVM_X86_SW_PROTECTED_VM, KVMIO, kvm_run__bindgen_ty_1}; +use kvm_bindings::{KVM_X86_SW_PROTECTED_VM, KVMIO}; #[cfg(target_arch = "x86_64")] use kvm_bindings::{Xsave as xsave2, kvm_xsave2}; pub use kvm_ioctls::{self, Cap, Kvm, VcpuExit}; @@ -1331,7 +1331,7 @@ impl vm::Vm for KvmVm { &self.fd.as_raw_fd(), TdxCommand::InitVm, 0, - &data as *const _ as *const _, + (&raw const data).cast(), ) .map_err(vm::HypervisorVmError::InitializeTdx) } @@ -1379,7 +1379,7 @@ impl vm::Vm for KvmVm { &self.fd.as_raw_fd(), TdxCommand::InitMemRegion, u32::from(measure), - &data as *const _ as *const _, + (&raw const data).cast(), ) .map_err(vm::HypervisorVmError::InitMemRegionTdx) } @@ -1417,7 +1417,7 @@ fn tdx_command( ioctl_with_val( fd, KVM_MEMORY_ENCRYPT_OP(), - &cmd as *const TdxIoctlCmd as std::os::raw::c_ulong, + &raw const cmd as std::os::raw::c_ulong, ) }; @@ -1677,7 +1677,7 @@ impl hypervisor::Hypervisor for KvmHypervisor { &self.kvm.as_raw_fd(), TdxCommand::Capabilities, 0, - &data as *const _ as *const _, + (&raw const data).cast(), ) .map_err(|e| hypervisor::HypervisorError::TdxCapabilities(e.into()))?; @@ -3155,8 +3155,7 @@ impl cpu::Vcpu for KvmVcpu { let kvm_run = self.fd.get_kvm_run(); // SAFETY: accessing a union field in a valid structure let tdx_vmcall = unsafe { - &mut (*((&mut kvm_run.__bindgen_anon_1) as *mut kvm_run__bindgen_ty_1 - as *mut KvmTdxExit)) + &mut (*((&raw mut kvm_run.__bindgen_anon_1).cast::())) .u .vmcall }; @@ -3184,8 +3183,7 @@ impl cpu::Vcpu for KvmVcpu { let kvm_run = self.fd.get_kvm_run(); // SAFETY: accessing a union field in a valid structure let tdx_vmcall = unsafe { - &mut (*((&mut kvm_run.__bindgen_anon_1) as *mut kvm_run__bindgen_ty_1 - as *mut KvmTdxExit)) + &mut (*((&raw mut kvm_run.__bindgen_anon_1).cast::())) .u .vmcall }; @@ -3243,7 +3241,7 @@ impl cpu::Vcpu for KvmVcpu { let cpu_attr_irq = kvm_bindings::kvm_device_attr { group: kvm_bindings::KVM_ARM_VCPU_PMU_V3_CTRL, attr: u64::from(kvm_bindings::KVM_ARM_VCPU_PMU_V3_IRQ), - addr: &irq as *const u32 as u64, + addr: &raw const irq as u64, flags: 0, }; self.fd diff --git a/hypervisor/src/kvm/riscv64/aia.rs b/hypervisor/src/kvm/riscv64/aia.rs index 67857c6ae..0915119af 100644 --- a/hypervisor/src/kvm/riscv64/aia.rs +++ b/hypervisor/src/kvm/riscv64/aia.rs @@ -45,7 +45,7 @@ impl KvmAiaImsics { &self.device, kvm_bindings::KVM_DEV_RISCV_AIA_GRP_CONFIG, u64::from(kvm_bindings::KVM_DEV_RISCV_AIA_CONFIG_MODE), - &mut aia_mode as *mut u32 as u64, + &raw mut aia_mode as u64, 0, )?; @@ -56,7 +56,7 @@ impl KvmAiaImsics { &self.device, kvm_bindings::KVM_DEV_RISCV_AIA_GRP_CONFIG, u64::from(kvm_bindings::KVM_DEV_RISCV_AIA_CONFIG_SRCS), - &nr_irqs as *const u32 as u64, + &raw const nr_irqs as u64, 0, )?; @@ -66,7 +66,7 @@ impl KvmAiaImsics { &self.device, kvm_bindings::KVM_DEV_RISCV_AIA_GRP_CONFIG, u64::from(kvm_bindings::KVM_DEV_RISCV_AIA_CONFIG_IDS), - &mut aia_nr_ids as *mut u32 as u64, + &raw mut aia_nr_ids as u64, 0, )?; @@ -79,7 +79,7 @@ impl KvmAiaImsics { &self.device, kvm_bindings::KVM_DEV_RISCV_AIA_GRP_CONFIG, u64::from(kvm_bindings::KVM_DEV_RISCV_AIA_CONFIG_HART_BITS), - &hart_bits as *const u32 as u64, + &raw const hart_bits as u64, 0, )?; @@ -90,7 +90,7 @@ impl KvmAiaImsics { &self.device, kvm_bindings::KVM_DEV_RISCV_AIA_GRP_ADDR, u64::from(kvm_bindings::KVM_DEV_RISCV_AIA_ADDR_APLIC), - &self.aplic_addr as *const u64 as u64, + &raw const self.aplic_addr as u64, 0, )?; @@ -107,7 +107,7 @@ impl KvmAiaImsics { &self.device, kvm_bindings::KVM_DEV_RISCV_AIA_GRP_ADDR, riscv_imsic_attr_of(cpu_index), - &cpu_imsic_addr as *const u64 as u64, + &raw const cpu_imsic_addr as u64, 0, )?; } diff --git a/hypervisor/src/kvm/x86_64/sev.rs b/hypervisor/src/kvm/x86_64/sev.rs index 390a0ca84..184690f99 100644 --- a/hypervisor/src/kvm/x86_64/sev.rs +++ b/hypervisor/src/kvm/x86_64/sev.rs @@ -207,7 +207,7 @@ impl SevFd { }; let mut sev_cmd = kvm_sev_cmd { id: KVM_SEV_INIT2, - data: &mut init as *mut KvmSevInit as _, + data: &raw mut init as u64, sev_fd: self.fd.as_raw_fd() as _, ..Default::default() }; @@ -221,7 +221,7 @@ impl SevFd { }; let mut sev_cmd = kvm_sev_cmd { id: KVM_SEV_SNP_LAUNCH_START, - data: &mut start as *mut KvmSevSnpLaunchStart as _, + data: &raw mut start as u64, sev_fd: self.fd.as_raw_fd() as _, ..Default::default() }; @@ -247,7 +247,7 @@ impl SevFd { }; let mut sev_cmd = kvm_sev_cmd { id: KVM_SEV_SNP_LAUNCH_UPDATE, - data: &mut update as *mut KvmSevSnpLaunchUpdate as _, + data: &raw mut update as u64, sev_fd: self.fd.as_raw_fd() as _, ..Default::default() }; @@ -276,7 +276,7 @@ impl SevFd { }; let mut sev_cmd = kvm_sev_cmd { id: KVM_SEV_SNP_LAUNCH_FINISH, - data: &mut finish as *mut KvmSevSnpLaunchFinish as _, + data: &raw mut finish as u64, sev_fd: self.fd.as_raw_fd() as _, ..Default::default() }; diff --git a/hypervisor/src/mshv/mod.rs b/hypervisor/src/mshv/mod.rs index 962045456..d38aff986 100644 --- a/hypervisor/src/mshv/mod.rs +++ b/hypervisor/src/mshv/mod.rs @@ -1961,7 +1961,7 @@ impl vm::Vm for MshvVm { // Return error return Err(vm::HypervisorVmError::MmapToRoot); } - Some(Ghcb(addr as *mut svm_ghcb_base)) + Some(Ghcb(addr.cast())) } else { None };