Re: [PATCH v5 01/24] rust: pci: use 'static lifetime for PCI BAR resource names

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] `Devres::new` lacks a `'static` bound on `T`, allowing safe Rust code to register objects with non-static lifetimes to the C devres subsystem and leak the `Devres` wrapper, leading to UAF on device unbind.
--

commit 1ea8f39dcd612a476e90616d2d99987a3bfdbf27
Author: Danilo Krummrich <dakr@kernel.org>

rust: pci: use 'static lifetime for PCI BAR resource names

This commit updates the lifetime of the name parameter in Bar::new and
iomap_region functions to a static CStr. This ensures the pointer remains
valid even if the Bar is leaked, preventing potential use-after-free issues
when pci_request_region stores the name pointer directly.

Closes: https://lore.kernel.org/all/20260522004943.CDA7C1F000E9@smtp.kernel.org/

> diff --git a/rust/kernel/pci/io.rs b/rust/kernel/pci/io.rs
> index ae78676c927ff..3ce21482b0797 100644
> --- a/rust/kernel/pci/io.rs
> +++ b/rust/kernel/pci/io.rs
[ ... ]
> @@ -249,10 +249,10 @@ impl Device<device::Bound> {
>      pub fn iomap_region_sized<'a, const SIZE: usize>(
>          &'a self,
>          bar: u32,
> -        name: &'a CStr,
> +        name: &'static CStr,
>      ) -> impl PinInit<Devres<Bar<SIZE>>, Error> + 'a {
>          Devres::new(self.as_ref(), Bar::<SIZE>::new(self, bar, name))

[Severity: High]
This isn't a bug introduced by this patch, but does Devres::new lack a
static bound on T?

Since Devres::new registers a C callback via devres_node_add() and can
intentionally leak a reference into the C devres subsystem (which is safe
in Rust via core::mem::forget), a user could pass an object with a
non-static lifetime.

The C devres subsystem will eventually drop the object upon device unbind,
which might happen long after any stack references have become invalid.

Should Devres or its constructor enforce a static bound on T to prevent
this potential use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260525202921.124698-1-dakr@kernel.org?part=1