Re: [PATCH v5 05/24] rust: driver core: drop drvdata before devres release

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Use-After-Free vulnerability in devres cleanup sequence due to premature Rust driver data destruction.
--

commit 7750f9ee9a8388dc1f41404481618c4bf5ae2148
Author: Danilo Krummrich <dakr@kernel.org>

rust: driver core: drop drvdata before devres release

This commit moves the post_unbind_rust callback before devres_release_all()
in device_unbind_cleanup(). This allows Rust driver structs to hold direct
references to devres-managed resources without dangling references.

> diff --git a/drivers/base/dd.c b/drivers/base/dd.c
> --- a/drivers/base/dd.c
> +++ b/drivers/base/dd.c
> @@ -595,9 +595,9 @@ static DEVICE_ATTR_RW(state_synced);
>  
>  static void device_unbind_cleanup(struct device *dev)
>  {
> -	devres_release_all(dev);
>  	if (dev->driver->p_cb.post_unbind_rust)
>  		dev->driver->p_cb.post_unbind_rust(dev);
> +	devres_release_all(dev);

[Severity: Critical]
Could moving the Rust post_unbind callback before devres_release_all()
trigger a use-after-free vulnerability?

If the driver data is dropped during post_unbind_rust(), but devres-managed
actions (such as shared interrupts or timer expirations) are still active,
can asynchronous events dereference the freed driver memory before
unregistration completes in devres_release_all()?

>  	arch_teardown_dma_ops(dev);
>  	kfree(dev->dma_range_map);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260525202921.124698-1-dakr@kernel.org?part=5