Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Missing module reference counting allows driver unload while files are open, leading to Use-After-Free -- --- Patch [3]: [PATCH 3/7] rust: drm: move file_operations from gem to device --- commit b811d43b7a27d7b6e1655586be106750c9eefba2 Author: Danilo Krummrich <[email protected]> rust: drm: move file_operations from gem to device Move the file_operations definition from drm::gem::create_fops() into UnregisteredDevice in drm::device. This is the file_operations of the DRM minor device, set through the drm_driver struct. It is not specific to GEM. > diff --git a/rust/kernel/drm/device.rs b/rust/kernel/drm/device.rs > index be83287fe161d..a2940e172073a 100644 > --- a/rust/kernel/drm/device.rs > +++ b/rust/kernel/drm/device.rs > @@ -195,10 +195,28 @@ const fn compute_features() -> u32 { > driver_features: Self::compute_features(), > ioctls: T::IOCTLS.as_ptr(), > num_ioctls: T::IOCTLS.len() as i32, > - fops: &Self::GEM_FOPS, > + fops: &Self::FOPS, > }; > > - const GEM_FOPS: bindings::file_operations = drm::gem::create_fops(); > + const FOPS: bindings::file_operations = { > + let mut fops: bindings::file_operations = pin_init::zeroed(); > + > + fops.owner = core::ptr::null_mut(); [Severity: High] This is a pre-existing issue, but does setting fops.owner to null_mut() allow the driver module to be unloaded while file descriptors remain open? If fops.owner is null, fops_get() in drm_stub_open() won't increment the driver module's reference count. A user could open the DRM device node, the module could be unloaded via rmmod (unmapping its .rodata section where FOPS resides), and subsequent ioctl or close operations would dereference filp->f_op into unmapped memory, causing a panic. Should this be updated to use the Rust equivalent of THIS_MODULE instead of null_mut() to ensure VFS module reference counting works correctly? [ ... ] -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=3
