Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Potential unaligned reference creation from `raw_data` when pointing to `stack_kdata`. -- commit 8f60afaa1c169bb0b033e33cedd40ffff2147401 Author: Danilo Krummrich <[email protected]> rust: drm: pin ioctl Device reference to Normal context Explicitly annotate the Device reference produced by from_raw() in the ioctl dispatch macro as Device<_, Normal>. This prevents the context from being inferred from the handler's first parameter type, ensuring a handler cannot obtain a Registered reference without runtime proof. > diff --git a/rust/kernel/drm/ioctl.rs b/rust/kernel/drm/ioctl.rs > index ccf4150d83b69..6f5a9877bdae0 100644 > --- a/rust/kernel/drm/ioctl.rs > +++ b/rust/kernel/drm/ioctl.rs > @@ -134,7 +134,8 @@ macro_rules! declare_drm_ioctls { > // FIXME: Currently there is nothing enforcing > that the types of the > // dev/file match the current driver these > ioctls are being declared > // for, and it's not clear how to enforce this > within the type system. > - let dev = > $crate::drm::device::Device::from_raw(raw_dev); > + let dev: &$crate::drm::device::Device<_, > $crate::drm::Normal> = > + > $crate::drm::device::Device::from_raw(raw_dev); > > // Enforce that the handler accepts higher-ranked > // lifetimes, preventing it from requiring > 'static [ ... ] > // The `ioctl` argument is exclusively owned by > the handler > // and guaranteed by the C implementation > (`drm_ioctl()`) to remain > // valid for the entire lifetime of the > reference taken here. > // There is no concurrent access or aliasing; no > other references > // to this object exist during this call. > let data = unsafe { &mut > *(raw_data.cast::<$crate::uapi::$struct>()) }; [Severity: High] This isn't a bug introduced by this patch, but does this create an unaligned reference? The C function drm_ioctl() allocates char stack_kdata[128]; on the stack for ioctl payloads <= 128 bytes, which only guarantees 1-byte alignment. When declare_drm_ioctls!() receives this pointer as raw_data and unconditionally casts it to create a mutable reference: let data = unsafe { &mut *(raw_data.cast::<$crate::uapi::$struct>()) }; it violates Rust's strict alignment rules for references. Creating a reference to under-aligned memory is immediate undefined behavior in Rust, regardless of whether the target architecture supports unaligned accesses. Because this path is reachable by any unprivileged userspace program calling DRM ioctls, could this lead to a denial of service if LLVM emits instructions that trap (such as vectorized operations)? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=10
