Re: [PATCH 3/7] rust: drm: move file_operations from gem to device

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing module reference counting allows driver unload while files are open, leading to Use-After-Free
--

--- Patch [3]: [PATCH 3/7] rust: drm: move file_operations from gem to device ---
commit b811d43b7a27d7b6e1655586be106750c9eefba2
Author: Danilo Krummrich <[email protected]>

rust: drm: move file_operations from gem to device

Move the file_operations definition from drm::gem::create_fops() into
UnregisteredDevice in drm::device. This is the file_operations of the
DRM minor device, set through the drm_driver struct. It is not specific
to GEM.

> diff --git a/rust/kernel/drm/device.rs b/rust/kernel/drm/device.rs
> index be83287fe161d..a2940e172073a 100644
> --- a/rust/kernel/drm/device.rs
> +++ b/rust/kernel/drm/device.rs
> @@ -195,10 +195,28 @@ const fn compute_features() -> u32 {
>          driver_features: Self::compute_features(),
>          ioctls: T::IOCTLS.as_ptr(),
>          num_ioctls: T::IOCTLS.len() as i32,
> -        fops: &Self::GEM_FOPS,
> +        fops: &Self::FOPS,
>      };
>  
> -    const GEM_FOPS: bindings::file_operations = drm::gem::create_fops();
> +    const FOPS: bindings::file_operations = {
> +        let mut fops: bindings::file_operations = pin_init::zeroed();
> +
> +        fops.owner = core::ptr::null_mut();

[Severity: High]
This is a pre-existing issue, but does setting fops.owner to null_mut()
allow the driver module to be unloaded while file descriptors remain open?

If fops.owner is null, fops_get() in drm_stub_open() won't increment the
driver module's reference count. A user could open the DRM device node,
the module could be unloaded via rmmod (unmapping its .rodata section
where FOPS resides), and subsequent ioctl or close operations would
dereference filp->f_op into unmapped memory, causing a panic.

Should this be updated to use the Rust equivalent of THIS_MODULE
instead of null_mut() to ensure VFS module reference counting works
correctly?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3