[PATCH] scsi: hpsa: Make buff allocation type unsigned

From: Kees Cook

Date: Thu Sep 17 2026 - 18:04:33 EST


From: Kees Cook <kees+treewide@xxxxxxxxxx>

In preparation for converting the kmalloc family of allocators to the
type-aware kmalloc_obj family, we need to make sure that the returned
type from the allocation matches the type of the variable being
assigned. (The kmalloc family returns "void *", which can be implicitly
cast to any pointer type.)

The assigned type is "unsigned char **", but the converted allocation
type would be "char **", whose elements point to a character type of a
different signedness, so the two pointer types are not compatible. Take
the size from the assignment target instead. No change in allocation
size results.

Build tested ARCH=x86_64 allmodconfig with GCC 16.2.0:
drivers/scsi/hpsa.o

Assisted-by: LLM coccinelle
Signed-off-by: Kees Cook <kees+treewide@xxxxxxxxxx>
---
Cc: Don Brace <don.brace@xxxxxxxxxxxxx>
Cc: "James E.J. Bottomley" <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx>
Cc: "Martin K. Petersen" <mkp@xxxxxxxxxx>
Cc: <storagedev@xxxxxxxxxxxxx>
Cc: <linux-scsi@xxxxxxxxxxxxxxx>
---
drivers/scsi/hpsa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 8edad1830abe..364cff7671e5 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -6499,7 +6499,7 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h,
return -EINVAL;
if (ioc->buf_size > ioc->malloc_size * SG_ENTRIES_IN_CMD)
return -EINVAL;
- buff = kcalloc(SG_ENTRIES_IN_CMD, sizeof(char *), GFP_KERNEL);
+ buff = kcalloc(SG_ENTRIES_IN_CMD, sizeof(*buff), GFP_KERNEL);
if (!buff) {
status = -ENOMEM;
goto cleanup1;
--
2.34.1