From 1824bff7d5dd5995ecd9e277f22976c77c76c930 Mon Sep 17 00:00:00 2001 From: Ka Wing Li Date: Sat, 7 Nov 2026 00:30:19 +0000 Subject: [PATCH 1/2] Fix subobject bounds issues in various places. --- sys/dev/virtio/block/virtio_blk.c | 2 +- sys/kern/kern_kthread.c | 5 +++-- sys/kern/kern_proc.c | 2 +- sys/kern/kern_prot.c | 3 ++- sys/kern/subr_uio.c | 3 ++- sys/netinet/in_pcb.c | 2 +- sys/netinet/tcp_subr.c | 2 +- sys/netinet/udp_usrreq.c | 2 +- sys/netinet6/udp6_usrreq.c | 2 +- sys/netlink/netlink_message_writer.c | 2 +- 10 files changed, 14 insertions(+), 11 deletions(-) diff --git a/sys/dev/virtio/block/virtio_blk.c b/sys/dev/virtio/block/virtio_blk.c index 5eb681128e9c..addf531c3386 100644 --- a/sys/dev/virtio/block/virtio_blk.c +++ b/sys/dev/virtio/block/virtio_blk.c @@ -901,7 +901,7 @@ vtblk_request_dequeue(struct vtblk_softc *sc) req = TAILQ_FIRST(&sc->vtblk_req_free); if (req != NULL) { TAILQ_REMOVE(&sc->vtblk_req_free, req, vbr_link); - bzero(&req->vbr_hdr, sizeof(struct vtblk_request) - + bzero(__unbounded_addressof(req->vbr_hdr), sizeof(struct vtblk_request) - offsetof(struct vtblk_request, vbr_hdr)); } diff --git a/sys/kern/kern_kthread.c b/sys/kern/kern_kthread.c index cfe2dab2e05c..a11d039cda15 100644 --- a/sys/kern/kern_kthread.c +++ b/sys/kern/kern_kthread.c @@ -292,9 +292,10 @@ kthread_add1(void (*func)(void *), void *arg, struct proc *p, if (newtdp != NULL) *newtdp = newtd; - bzero(&newtd->td_startzero, + bzero(__unbounded_addressof(newtd->td_startzero), __rangeof(struct thread, td_startzero, td_endzero)); - bcopy(&oldtd->td_startcopy, &newtd->td_startcopy, + bcopy(__unbounded_addressof(oldtd->td_startcopy), + __unbounded_addressof(newtd->td_startcopy), __rangeof(struct thread, td_startcopy, td_endcopy)); /* set up arg0 for 'ps', et al */ diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c index 04b9314de6cb..9c02ae172aee 100644 --- a/sys/kern/kern_proc.c +++ b/sys/kern/kern_proc.c @@ -1400,7 +1400,7 @@ void pstats_fork(struct pstats *src, struct pstats *dst) { - bzero(&dst->pstat_startzero, + bzero(__unbounded_addressof(dst->pstat_startzero), __rangeof(struct pstats, pstat_startzero, pstat_endzero)); bcopy(&src->pstat_startcopy, &dst->pstat_startcopy, __rangeof(struct pstats, pstat_startcopy, pstat_endcopy)); diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c index fdc4187679fb..7412d69fbf11 100644 --- a/sys/kern/kern_prot.c +++ b/sys/kern/kern_prot.c @@ -2729,7 +2729,8 @@ void crcopy(struct ucred *dest, struct ucred *src) { - bcopy(&src->cr_startcopy, &dest->cr_startcopy, + bcopy(__unbounded_addressof(src->cr_startcopy), + __unbounded_addressof(dest->cr_startcopy), (unsigned)((caddr_t)&src->cr_endcopy - (caddr_t)&src->cr_startcopy)); dest->cr_flags = src->cr_flags; diff --git a/sys/kern/subr_uio.c b/sys/kern/subr_uio.c index a6d6cb8b417e..d96a9d9c9846 100644 --- a/sys/kern/subr_uio.c +++ b/sys/kern/subr_uio.c @@ -544,7 +544,8 @@ cloneuio(struct uio *uiop) int iovlen; uio = allocuio(uiop->uio_iovcnt); - bcopy(&uiop->uio_startcopy, &uio->uio_startcopy, + bcopy(__unbounded_addressof(uiop->uio_startcopy), + __unbounded_addressof(uio->uio_startcopy), __rangeof(struct uio, uio_startcopy, uio_endcopy)); iovlen = uiop->uio_iovcnt * sizeof(struct iovec); bcopy(uiop->uio_iov, uio->uio_iov, iovlen); diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c index 35ced5dab05c..34f424db435e 100644 --- a/sys/netinet/in_pcb.c +++ b/sys/netinet/in_pcb.c @@ -639,7 +639,7 @@ in_pcballoc(struct socket *so, struct inpcbinfo *pcbinfo) inp = uma_zalloc_smr(pcbinfo->ipi_zone, M_NOWAIT); if (inp == NULL) return (ENOBUFS); - bzero(&inp->inp_start_zero, inp_zero_size); + bzero(__unbounded_addressof(inp->inp_start_zero), inp_zero_size); #ifdef NUMA inp->inp_numa_domain = M_NODOM; #endif diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index 291a5ab52652..fdc7cdde6796 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -2215,7 +2215,7 @@ tcp_newtcpcb(struct inpcb *inp, struct tcpcb *listening_tcb) * code that rely on that. For now take safe approach and zero whole * tcpcb. This definitely can be optimized. */ - bzero(&tp->t_start_zero, t_zero_size); + bzero(__unbounded_addressof(tp->t_start_zero), t_zero_size); /* Initialise cc_var struct for this tcpcb. */ tp->t_ccv.tp = tp; diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c index 06b5b214f128..2009ca330ada 100644 --- a/sys/netinet/udp_usrreq.c +++ b/sys/netinet/udp_usrreq.c @@ -1539,7 +1539,7 @@ udp_attach(struct socket *so, int proto, struct thread *td) inp->inp_flowid = atomic_fetchadd_int(&udp_flowid, 1); inp->inp_flowtype = M_HASHTYPE_OPAQUE; up = intoudpcb(inp); - bzero(&up->u_start_zero, u_zero_size); + bzero(__unbounded_addressof(up->u_start_zero), u_zero_size); INP_WUNLOCK(inp); return (0); diff --git a/sys/netinet6/udp6_usrreq.c b/sys/netinet6/udp6_usrreq.c index 0027cf3bd230..8c75fc5d6e4c 100644 --- a/sys/netinet6/udp6_usrreq.c +++ b/sys/netinet6/udp6_usrreq.c @@ -1038,7 +1038,7 @@ udp6_attach(struct socket *so, int proto, struct thread *td) */ inp->inp_ip_ttl = V_ip_defttl; up = intoudpcb(inp); - bzero(&up->u_start_zero, u_zero_size); + bzero(__unbounded_addressof(up->u_start_zero), u_zero_size); INP_WUNLOCK(inp); return (0); } diff --git a/sys/netlink/netlink_message_writer.c b/sys/netlink/netlink_message_writer.c index 8c5b3ec14058..9f420d05809c 100644 --- a/sys/netlink/netlink_message_writer.c +++ b/sys/netlink/netlink_message_writer.c @@ -298,7 +298,7 @@ nlmsg_ack(struct nlpcb *nlp, int error, struct nlmsghdr *hdr, errmsg = nlmsg_reserve_data(nw, payload_len, struct nlmsgerr); errmsg->error = error; /* In case of error copy the whole message, else just the header */ - memcpy(&errmsg->msg, hdr, cap_ack ? sizeof(*hdr) : hdr->nlmsg_len); + memcpy(__unbounded_addressof(errmsg->msg), hdr, cap_ack ? sizeof(*hdr) : hdr->nlmsg_len); if (npt->err_msg != NULL && nlp->nl_flags & NLF_EXT_ACK) nlattr_add_string(nw, NLMSGERR_ATTR_MSG, npt->err_msg); From 805d9cda44b68b9712413c7b46ba9d43692e33b5 Mon Sep 17 00:00:00 2001 From: Ka Wing Li Date: Mon, 9 Nov 2026 12:05:59 +0000 Subject: [PATCH 2/2] Fix subobject bounds in kernel thread. --- sys/kern/kern_thr.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_thr.c b/sys/kern/kern_thr.c index 507a3dea8f9b..0846f2021e72 100644 --- a/sys/kern/kern_thr.c +++ b/sys/kern/kern_thr.c @@ -245,9 +245,10 @@ thread_create(struct thread *td, struct rtprio *rtp, if (error) goto fail; - bzero(&newtd->td_startzero, + bzero(__unbounded_addressof(newtd->td_startzero), __rangeof(struct thread, td_startzero, td_endzero)); - bcopy(&td->td_startcopy, &newtd->td_startcopy, + bcopy(__unbounded_addressof(td->td_startcopy), + __unbounded_addressof(newtd->td_startcopy), __rangeof(struct thread, td_startcopy, td_endcopy)); newtd->td_proc = td->td_proc; newtd->td_rb_list = newtd->td_rbp_list = newtd->td_rb_inact = 0;