Re: [RFC PATCH v6 1/5] rust: DmaFence: remove static lifetime

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] rust: missing `# Safety` documentation for `unsafe fn new` exposing UAF on leak
--

commit beab119634d6183863230115e35c006b11edee53
Author: Philipp Stanner <phasta@kernel.org>

rust: DmaFence: remove static lifetime

(will be upstreamed separately)

> diff --git a/rust/kernel/dma_buf/dma_fence.rs b/rust/kernel/dma_buf/dma_fence.rs
> index 18a43e1bb442f..eef2b9e93f356 100644
> --- a/rust/kernel/dma_buf/dma_fence.rs
> +++ b/rust/kernel/dma_buf/dma_fence.rs

[ ... ]

> @@ -326,7 +326,7 @@ impl<T: FenceCallback> FenceCallbackRegistration<T> {
>      /// On success the callback is pinned in place and will fire when the fence
>      /// signals. On `AlreadySignaled` the callback is returned to the caller so
>      /// that owned resources can be reclaimed.
> -    pub fn new<'a>(fence: &'a Fence, callback: T) -> impl PinInit<Self, CallbackError<T>> + 'a
> +    pub unsafe fn new<'a>(fence: &'a Fence, callback: T) -> impl PinInit<Self, CallbackError<T>> + 'a

[Severity: Medium]
Since this patch removes the 'static bound from FenceCallbackRegistration
and makes FenceCallbackRegistration::new() unsafe to prevent callbacks from
outliving their captured references, does this function also need a
/// # Safety documentation block?

According to the Rust coding guidelines, unsafe functions must document
their safety preconditions. Without it, callers aren't explicitly informed
of their obligation to prevent leaks (e.g. via core::mem::forget) which
could bypass the Drop implementation and leave a dangling callback pointer
that eventually causes a use-after-free when the fence signals.

>      where
>          T: 'a,
>      {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016085724.1031766-2-phasta@kernel.org?part=1