linux-kernel - [PATCH 1/2] rust: usb: don't retain device context for the interface parent

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250925190400.144699-1-dakr@kernel.org>
Date: Thu, 25 Sep 2025 20:59:26 +0200
From: Danilo Krummrich <dakr@...nel.org>
To: gregkh@...uxfoundation.org,
	stern@...land.harvard.edu,
	ojeda@...nel.org,
	alex.gaynor@...il.com,
	boqun.feng@...il.com,
	gary@...yguo.net,
	bjorn3_gh@...tonmail.com,
	lossin@...nel.org,
	a.hindborg@...nel.org,
	aliceryhl@...gle.com,
	tmgross@...ch.edu,
	daniel.almeida@...labora.com
Cc: rust-for-linux@...r.kernel.org,
	linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Danilo Krummrich <dakr@...nel.org>
Subject: [PATCH 1/2] rust: usb: don't retain device context for the interface parent

When deriving the parent USB device (struct usb_device) from a USB
interface (struct usb_interface), do not retain the device context.

For the Bound context, as pointed out by Alan in [1], it is not
guaranteed that the parent USB device is always bound when the interface
is bound.

The bigger problem, however, is that we can't infer the Core context,
since eventually it indicates that the device lock is held. However,
there is no guarantee that if the device lock of the interface is held,
also the device lock of the parent USB device is held.

Hence, fix this by not inferring any device context information; while
at it, fix up the (affected) safety comments.

Link: https://lore.kernel.org/all/0ff2a825-1115-426a-a6f9-df544cd0c5fc@rowland.harvard.edu/ [1]
Fixes: e7e2296b0ecf ("rust: usb: add basic USB abstractions")
Signed-off-by: Danilo Krummrich <dakr@...nel.org>
---
Deriving the parent device will be needed (at least from within the
abstraction), hence I kept the AsRef implementation and only dropped the
inferred device context information.

Regardless, I'm not sure AsRef is really what we want here. A simple
Interface::parent() method seems more appropriate to me, but this patch focuses
on fixing the bug, hence I kept AsRef.
---
 rust/kernel/usb.rs | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/rust/kernel/usb.rs b/rust/kernel/usb.rs
index 8899e7520b58..955fd93b6f52 100644
--- a/rust/kernel/usb.rs
+++ b/rust/kernel/usb.rs
@@ -340,14 +340,13 @@ fn as_ref(&self) -> &device::Device<Ctx> {
     }
 }
 
-impl<Ctx: device::DeviceContext> AsRef<Device<Ctx>> for Interface<Ctx> {
-    fn as_ref(&self) -> &Device<Ctx> {
-        // SAFETY: `self.as_raw()` is valid by the type invariants. For a valid interface,
-        // the helper should always return a valid USB device pointer.
+impl<Ctx: device::DeviceContext> AsRef<Device> for Interface<Ctx> {
+    fn as_ref(&self) -> &Device {
+        // SAFETY: `self.as_raw()` is valid by the type invariants.
         let usb_dev = unsafe { bindings::interface_to_usbdev(self.as_raw()) };
 
-        // SAFETY: The helper returns a valid interface pointer that shares the
-        // same `DeviceContext`.
+        // SAFETY: For a valid `struct usb_interface` pointer, the above call to
+        // `interface_to_usbdev()` guarantees to return a valid pointer to a `struct usb_device`.
         unsafe { &*(usb_dev.cast()) }
     }
 }

base-commit: c584a1c7c8a192c13637bc51c7b63a9f15fe6474
-- 
2.51.0