linux-kernel - Re: [PATCH] rust: opp: simplify callers of `to_c_str

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJ-ks9=2217VUNyGq9Z9hiZJfcjSYzzXy8WMh-0jD0a=a2eYJA@mail.gmail.com>
Date: Thu, 23 Oct 2025 09:24:56 -0400
From: Tamir Duberstein <tamird@...nel.org>
To: Viresh Kumar <viresh.kumar@...aro.org>
Cc: Viresh Kumar <vireshk@...nel.org>, Nishanth Menon <nm@...com>, Stephen Boyd <sboyd@...nel.org>, 
	Miguel Ojeda <ojeda@...nel.org>, Alex Gaynor <alex.gaynor@...il.com>, 
	Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>, 
	Björn Roy Baron <bjorn3_gh@...tonmail.com>, 
	Benno Lossin <lossin@...nel.org>, Andreas Hindborg <a.hindborg@...nel.org>, 
	Alice Ryhl <aliceryhl@...gle.com>, Trevor Gross <tmgross@...ch.edu>, 
	Danilo Krummrich <dakr@...nel.org>, linux-pm@...r.kernel.org, rust-for-linux@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] rust: opp: simplify callers of `to_c_str_array`

On Thu, Oct 23, 2025 at 7:32 AM Viresh Kumar <viresh.kumar@...aro.org> wrote:
>
> On 22-10-25, 07:22, Tamir Duberstein wrote:
> > I believe the `{clk,regulator}_names` vector bindings remain alive for
> > the whole scope, even if they are shadowed. See
> > https://play.rust-lang.org/?version=stable&mode=debug&edition=2024&gist=800b334c514c2024d7b5e47fc54c1f2d.
>
> I tried to print the name of the regulator and clk in the C code:
>
> diff --git a/drivers/opp/core.c b/drivers/opp/core.c
> index d67d392e16d4..89b65fe07b99 100644
> --- a/drivers/opp/core.c
> +++ b/drivers/opp/core.c
> @@ -2565,6 +2565,8 @@ int dev_pm_opp_set_config(struct device *dev, struct dev_pm_opp_config *config)
>                 goto err;
>         }
>
> +       pr_info("%s: %d: %s: %s\n", __func__, __LINE__, config->clk_names[0], config->regulator_names[0]);
>
> and I get this:
>
> [    2.358437] core: dev_pm_opp_set_config: 2568: �<��y����<��y���x��: �<��y����<��y���x��
>
>
>
> With following diff applied over your patch, it works again:
>
> diff --git a/rust/kernel/opp.rs b/rust/kernel/opp.rs
> index 743080e14292..02cb754c4abd 100644
> --- a/rust/kernel/opp.rs
> +++ b/rust/kernel/opp.rs
> @@ -444,13 +444,13 @@ pub fn set_supported_hw(mut self, hw: KVec<u32>) -> Result<Self> {
>      /// The returned [`ConfigToken`] will remove the configuration when dropped.
>      pub fn set(self, dev: &Device) -> Result<ConfigToken> {
>          let clk_names = self.clk_names.as_deref().map(to_c_str_array).transpose()?;
> -        let clk_names = clk_names.map_or(ptr::null(), |c| c.as_ptr());
> +        let clk_names = clk_names.as_ref().map_or(ptr::null(), |c| c.as_ptr());
>          let regulator_names = self
>              .regulator_names
>              .as_deref()
>              .map(to_c_str_array)
>              .transpose()?;
> -        let regulator_names = regulator_names.map_or(ptr::null(), |c| c.as_ptr());
> +        let regulator_names = regulator_names.as_ref().map_or(ptr::null(), |c| c.as_ptr());
>
>          let prop_name = self
>              .prop_name
>
>
> and I get:
>
> [    2.460149] core: dev_pm_opp_set_config: 2568: dummy_clk: dummy_reg

Good catch. This should really be a lot more defensive so the compiler
catches this kind of use-after-free. I'll send v2 shortly.