On Wed Sep 9, 2026 at 7:44 AM BST, Alistair Popple wrote: > The closure passed to registration_data_with() currently receives > `Pin<&'a F::Of<'a>>` with `'a` universally quantified. This prevents the > closure from returning references derived from the registration data, > even for sub-fields that are covariant in their lifetime, because the > compiler cannot relate `'a` to any lifetime the caller knows about. > > Tie the outer reference to the `&self` lifetime instead, i.e. pass > `Pin<&'this F::Of<'a>>`. This gives the closure the implied bound > `'a: 'this`, so covariant sub-fields such as `&'a T` can be coerced to > `'this` and returned directly, while invariant fields still cannot be > coerced and therefore cannot escape with an incorrect lifetime. > > This allows auxiliary child drivers to project covariant data out of > invariant registration data without having to wrap every use in a > closure.
Looking at this again I think the current API might be unsound where this patch becomes fix rather than just a feature update. For an invariant `&'b F::Of<'a>`, it's actually a requirement that `'a` strictly outlive `'b`. With the current API surface, we can obtain a `&'a F::Of<'a>`, then we can store it inside `F::Of<'a>` (because, well, F::Of<'a> being invariant, it can internally have a `Mutex<Option<F::Of<'a>>`), and then we're able to UAF within the destruction code of `F::Of<'a>`. The fix, is, well, this patch. Would you might pulling this patch out, rework the commit message a bit and send as a standalone fix? Best, Gary > > Link: https://lore.kernel.org/nova-gpu/[email protected]/ > Suggested-by: Gary Guo <[email protected]> > Co-developed-by: Danilo Krummrich <[email protected]> > Signed-off-by: Alistair Popple <[email protected]> > > --- > > Changes since v5: > > - New for v6 > --- > rust/kernel/auxiliary.rs | 17 +++++++++++------ > 1 file changed, 11 insertions(+), 6 deletions(-) > > diff --git a/rust/kernel/auxiliary.rs b/rust/kernel/auxiliary.rs > index 60dfbec8f330..06f816420790 100644 > --- a/rust/kernel/auxiliary.rs > +++ b/rust/kernel/auxiliary.rs > @@ -305,6 +305,10 @@ unsafe fn registration_data_pinned<F: ForLt + > 'static>(&self) -> Result<Pin<&F:: > /// `F` is the [`ForLt`](trait@ForLt) encoding of the data type. The > closure receives a pinned > /// reference to the registration data. > /// > + /// The outer reference carries the `&self` lifetime while the inner > type carries the HRTB > + /// lifetime `'a`, implying `'a` outlives `&self`. This allows the > closure to coerce covariant > + /// sub-fields (e.g. `&'a T` to the caller's lifetime) and return them > directly in `R`. > + /// > /// For covariant types that implement [`trait@CovariantForLt`], prefer > /// [`registration_data`](Self::registration_data) which returns a > direct reference. > /// > @@ -314,13 +318,14 @@ unsafe fn registration_data_pinned<F: ForLt + > 'static>(&self) -> Result<Pin<&F:: > /// Returns [`ENOENT`] if no registration data has been set, e.g. when > the device was > /// registered by a C driver. > #[inline] > - pub fn registration_data_with<F: ForLt + 'static, R>( > - &self, > - f: impl for<'a> FnOnce(Pin<&'a F::Of<'a>>) -> R, > + pub fn registration_data_with<'this, F: ForLt + 'static, R>( > + &'this self, > + f: impl for<'a> FnOnce(Pin<&'this F::Of<'a>>) -> R, > ) -> Result<R> { > - // SAFETY: The HRTB closure prevents the caller from smuggling in > references with a > - // concrete short lifetime, making the round-trip from `'static` > sound regardless of > - // variance. > + // SAFETY: The HRTB on the inner type prevents the caller from > exploiting a specific > + // choice of `'a`. Covariant sub-fields can be safely coerced to > `'this`, while > + // invariant fields cannot be coerced and thus cannot escape with an > incorrect > + // lifetime. > let pinned = unsafe { self.registration_data_pinned::<F>()? }; > > Ok(f(pinned))
