Dear Linux kernel maintainers,
We are developing a tool called FerroLens to detect potential
unsound behavior in Rust code in the Linux kernel. The tool
internally uses an LLM to detect bugs.
We then perform manual analysis to verify these reports.
FerroLens reported the following bug in rust/kernel/module_param.rs:
The `set_param` function casts `kernel_param.arg` to `*const SetOnce<T>`
But the Rust module macro in rust/macros/module.rs initializes `arg` with
`#param_name.as_void_ptr()`, and `#param_name` is a `ModuleParamAccess<T>`,
not a `SetOnce<T>`.
ModuleParamAccess<T> has default Rust layout but `set_param` accesses its
first field SetOnce<T> assuming it to be at offset 0. This is not
guaranteed by Rust and if SetOnce<T> is not at offset 0 it could cause
type confusion leading to data corruption.
In particular, if the kernel is built with a randomized layout
(e.g with KRUSTFLAGS='-Zrandomize-layout=yes -Zlayout-seed=1'),
the first field of `ModuleParamAccess<T>` may not be at offset 0.
This leads to incorrect behavior when loading the rust_minimal module
from samples.
$ sudo insmod samples/rust/rust_minimal.ko test_parameter=1
test_bool_parameter=false
insmod: ERROR: could not insert module samples/rust/rust_minimal.ko: File exists
[ 854.638251] rust_minimal: `1' invalid for parameter `test_parameter'
Priya Bala Govindasamy (1):
rust: module_param: Fix potentially incorrect layout for
`ModuleParamAccess<T>`
rust/kernel/module_param.rs | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--
2.34.1
