Re: [PATCH 07/10] rust: io: add subregion method with compile-time check

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The `subregion` method incorrectly initializes the new subregion's runtime size using `ptr.len() - OFFSET` instead of `NEW_SIZE`, defeating encapsulation and enabling out-of-bounds MMIO accesses.
--

--- Patch [7]: [PATCH 07/10] rust: io: add subregion method with compile-time check ---
commit 3d97a4ac48567402f60659310de26681110a1c61
Author: Gary Guo <gary@garyguo.net>

rust: io: add subregion method with compile-time check

This commit adds a compile-time checked subregion helper function to Region.
This allows drivers to obtain a safely constrained subregion for relative
register access.

> diff --git a/rust/kernel/io.rs b/rust/kernel/io.rs
> index 0f8b166a6d3bb..f31d37c8a3d58 100644
> --- a/rust/kernel/io.rs
> +++ b/rust/kernel/io.rs

[ ... ]

> +    /// Create a subregion with provided offset and size.
> +    #[inline]
> +    pub fn subregion<'a, const OFFSET: usize, const NEW_SIZE: usize, IO>(
> +        io: IO,
> +    ) -> <IO::Backend as IoBackend>::View<'a, Region<NEW_SIZE>>
> +    where
> +        IO: IoBase<'a, Target = Self>,
> +    {
> +        const_assert!(
> +            OFFSET + NEW_SIZE <= SIZE && OFFSET.is_multiple_of(4) && NEW_SIZE.is_multiple_of(4)
> +        );
> +
> +        let view = io.as_view();
> +        let ptr = IO::Backend::as_ptr(view) as *mut [u8];
> +        let new_ptr = Region::ptr_from_raw_parts_mut(
> +            ptr.cast::<u8>().wrapping_add(OFFSET),
> +            ptr.len() - OFFSET,

[Severity: High]
Does this improperly initialize the new subregion's runtime size using
ptr.len() - OFFSET instead of NEW_SIZE?

If a parent driver creates a localized subregion specifying a NEW_SIZE and
delegates it to a sub-device driver, the sub-device could mistakenly execute
fallible MMIO operations beyond the intended NEW_SIZE.

Because the runtime dynamic bounds checking will evaluate against
ptr.len() - OFFSET instead of the constrained size, out-of-bounds accesses
would improperly succeed and could corrupt adjacent registers.

Should this be updated to pass NEW_SIZE to ptr_from_raw_parts_mut?

> +        );
> +
> +        // SAFETY: We have checked that the new region is a subregion and it is aligned, hence it is
> +        // a valid projection.
> +        unsafe { IO::Backend::project_view(view, new_ptr) }
> +    }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721-typed_register-v1-0-452d72b60262@garyguo.net?part=7