Re: [PATCH v5 10/19] rust: drm: pin ioctl Device reference to Normal context

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Potential unaligned reference creation from `raw_data` when pointing to `stack_kdata`.
--

commit 8f60afaa1c169bb0b033e33cedd40ffff2147401
Author: Danilo Krummrich <dakr@kernel.org>

rust: drm: pin ioctl Device reference to Normal context

Explicitly annotate the Device reference produced by from_raw() in the ioctl
dispatch macro as Device<_, Normal>. This prevents the context from being
inferred from the handler's first parameter type, ensuring a handler cannot
obtain a Registered reference without runtime proof.

> diff --git a/rust/kernel/drm/ioctl.rs b/rust/kernel/drm/ioctl.rs
> index ccf4150d83b69..6f5a9877bdae0 100644
> --- a/rust/kernel/drm/ioctl.rs
> +++ b/rust/kernel/drm/ioctl.rs
> @@ -134,7 +134,8 @@ macro_rules! declare_drm_ioctls {
>                              // FIXME: Currently there is nothing enforcing that the types of the
>                              // dev/file match the current driver these ioctls are being declared
>                              // for, and it's not clear how to enforce this within the type system.
> -                            let dev = $crate::drm::device::Device::from_raw(raw_dev);
> +                            let dev: &$crate::drm::device::Device<_, $crate::drm::Normal> =
> +                                $crate::drm::device::Device::from_raw(raw_dev);
>  
>                              // Enforce that the handler accepts higher-ranked
>                              // lifetimes, preventing it from requiring 'static
[ ... ]
>                              // The `ioctl` argument is exclusively owned by the handler
>                              // and guaranteed by the C implementation (`drm_ioctl()`) to remain
>                              // valid for the entire lifetime of the reference taken here.
>                              // There is no concurrent access or aliasing; no other references
>                              // to this object exist during this call.
>                              let data = unsafe { &mut *(raw_data.cast::<$crate::uapi::$struct>()) };

[Severity: High]
This isn't a bug introduced by this patch, but does this create an unaligned
reference?

The C function drm_ioctl() allocates char stack_kdata[128]; on the stack for
ioctl payloads <= 128 bytes, which only guarantees 1-byte alignment.

When declare_drm_ioctls!() receives this pointer as raw_data and
unconditionally casts it to create a mutable reference:

    let data = unsafe { &mut *(raw_data.cast::<$crate::uapi::$struct>()) };

it violates Rust's strict alignment rules for references.

Creating a reference to under-aligned memory is immediate undefined behavior
in Rust, regardless of whether the target architecture supports unaligned
accesses.

Because this path is reachable by any unprivileged userspace program calling
DRM ioctls, could this lead to a denial of service if LLVM emits instructions
that trap (such as vectorized operations)?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260628145406.2107056-1-dakr@kernel.org?part=10