[PATCH 0/1] rust: module_param: Fix potentially incorrect access of `SetOnce<T>`

[Priya Bala Govindasamy <pgovind2@uci.edu>]

Dear Linux kernel maintainers,

We are developing a tool called FerroLens to detect potential 
unsound behavior in Rust code in the Linux kernel. The tool 
internally uses an LLM to detect bugs.
We then perform manual analysis to verify these reports. 
FerroLens reported the following bug in rust/kernel/module_param.rs:

The `set_param` function casts `kernel_param.arg` to `*const SetOnce<T>`
But the Rust module macro in rust/macros/module.rs initializes `arg` with 
`#param_name.as_void_ptr()`, and `#param_name` is a `ModuleParamAccess<T>`,
not a `SetOnce<T>`.

ModuleParamAccess<T> has default Rust layout but `set_param` accesses its 
first field SetOnce<T> assuming it to be at offset 0. This is not 
guaranteed by Rust and if SetOnce<T> is not at offset 0 it could cause 
type confusion leading to data corruption.

In particular, if the kernel is built with a randomized layout 
(e.g with KRUSTFLAGS='-Zrandomize-layout=yes -Zlayout-seed=1'), 
the first field of `ModuleParamAccess<T>` may not be at offset 0. 
This leads to incorrect behavior when loading the rust_minimal module 
from samples.

$ sudo insmod samples/rust/rust_minimal.ko test_parameter=1 test_bool_parameter=false
insmod: ERROR: could not insert module samples/rust/rust_minimal.ko: File exists

[  854.638251] rust_minimal: `1' invalid for parameter `test_parameter'

Priya Bala Govindasamy (1):
  rust: module_param: Fix potentially incorrect layout for 
    `ModuleParamAccess<T>`

 rust/kernel/module_param.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

-- 
2.34.1