On Thu Jun 26, 2025 at 10:00 PM CEST, Danilo Krummrich wrote: > So far Devres uses an inner memory allocation and reference count, i.e. > an inner Arc, in order to ensure that the devres callback can't run into > a use-after-free in case where the Devres object is dropped while the > devres callback runs concurrently. > > Instead, use a completion in order to avoid a potential UAF: In > Devres::drop(), if we detect that we can't remove the devres action > anymore, we wait for the completion that is completed from the devres > callback. If, in turn, we were able to successfully remove the devres > action, we can just go ahead. > > This, again, allows us to get rid of the internal Arc, and instead let > Devres consume an `impl PinInit<T, E>` in order to return an > `impl PinInit<Devres<T>, E>`, which enables us to get away with less > memory allocations. > > Additionally, having the resulting explicit synchronization in > Devres::drop() prevents potential subtle undesired side effects of the > devres callback dropping the final Arc reference asynchronously within > the devres callback. > > Signed-off-by: Danilo Krummrich <dakr@xxxxxxxxxx> With the invariants section moved: Reviewed-by: Benno Lossin <lossin@xxxxxxxxxx> --- Cheers, Benno > --- > drivers/gpu/nova-core/driver.rs | 7 +- > drivers/gpu/nova-core/gpu.rs | 6 +- > rust/kernel/devres.rs | 213 +++++++++++++++++++------------- > rust/kernel/pci.rs | 20 +-- > samples/rust/rust_driver_pci.rs | 19 +-- > 5 files changed, 154 insertions(+), 111 deletions(-)
