Patch "rust: macros: provide correct provenance when constructing THIS_MODULE" has been added to the 6.1-stable tree

This is a note to let you know that I've just added the patch titled

rust: macros: provide correct provenance when constructing THIS_MODULE

to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
rust-macros-provide-correct-provenance-when-construc.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

commit 5b320b29ddf985d8de92c3afa9aebe13ecd5cfad

Author: Boqun Feng <[email protected]>
Date:   Wed Aug 28 11:01:29 2024 -0700

rust: macros: provide correct provenance when constructing THIS_MODULE

[ Upstream commit a5a3c952e82c1ada12bf8c55b73af26f1a454bd2 ]

Currently while defining THIS_MODULE symbol in module!(), the pointer used to construct ThisModule is derived from an immutable reference of __this_module, which means the pointer doesn't have the provenance for writing, and that means any write to that pointer is UB regardless of data races or not. However, the usage of THIS_MODULE includes passing this pointer to functions that may write to it (probably in unsafe code), and this will create soundness issues.

One way to fix this is using addr_of_mut!() but that requires the unstable feature "const_mut_refs". So instead of addr_of_mut()!, an extern static Opaque is used here: since Opaque<T> is transparent to T, an extern static Opaque will just wrap the C symbol (defined in a C compile unit) in an Opaque, which provides a pointer with writable provenance via Opaque::get(). This fix the potential UBs because of pointer provenance unmatched.

Reported-by Alice Ryhl <[email protected]>

Signed-off-by Boqun Feng <[email protected]>

Reviewed-by Alice Ryhl <[email protected]>

Reviewed-by Trevor Gross <[email protected]>

Reviewed-by Benno Lossin <[email protected]>

Reviewed-by Gary Guo <[email protected]>

Closes https://rust-for-linux.zulipchat.com/#narrow/stream/x/topic/x/near/465412664

Fixes 1fbde52bde73 ("rust: add `macros` crate")

Cc [email protected] # 6.6.x: be2ca1e03965: ("rust: types: Make Opaque::get const")

Link https://lore.kernel.org/r/[email protected] open here

[ Fixed two typos, reworded title. - Miguel ]

Signed-off-by Miguel Ojeda <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

rust/macros/module.rs +5 -1

index 031028b3dc41..071b96639a2e 100644
@@ -183,7 +183,11 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream {
             // freed until the module is unloaded.
             #[cfg(MODULE)]
             static THIS_MODULE: kernel::ThisModule = unsafe {{
-                kernel::ThisModule::from_ptr(&kernel::bindings::__this_module as *const _ as *mut _)
+                extern \"C\" {{
+                    static __this_module: kernel::types::Opaque<kernel::bindings::module>;
+                }}
+
+                kernel::ThisModule::from_ptr(__this_module.get())
             }};
             #[cfg(not(MODULE))]
             static THIS_MODULE: kernel::ThisModule = unsafe {{

Quoted 2 lines · On Mon, 9 Sep 2024 08:48:14 -0400 Sasha Levin <[email protected]> wrote:

    Fixes: 1fbde52bde73 ("rust: add `macros` crate")
    Cc: [email protected] # 6.6.x: be2ca1e03965: ("rust: types: Make Opaque::get const")

The Opaque type doesn't exist yet in 6.1, so this patch should not be applied to it.