Pull driver core fixes from Danilo Krummrich: - Always inline I/O and IRQ methods using build_assert!() to avoid false positive build errors - Do not free the driver's device private data in I2C shutdown() avoiding race conditions that can lead to UAF bugs - Drop the driver's device private data after the driver has been fully unbound from its device to avoid UAF bugs from &Device<Bound> scopes, such as IRQ callbacks * tag 'driver-core-6.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: rust: driver: drop device private data post unbind rust: driver: add DriverData type to the DriverLayout trait rust: driver: add DEVICE_DRIVER_OFFSET to the DriverLayout trait rust: driver: introduce a DriverLayout trait rust: auxiliary: add Driver::unbind() callback rust: i2c: do not drop device private data on shutdown() rust: irq: always inline functions using build_assert with arguments rust: io: always inline functions using build_assert with arguments
Showing the changes to include/linux (1 of 12 files). Show all
Unified · Split
| @@ -85,6 +85,8 @@ enum probe_type { · 84 unmodified lines | |||
| 85 | * uevent. | 85 | * uevent. |
| 86 | * @p: Driver core's private data, no one other than the driver | 86 | * @p: Driver core's private data, no one other than the driver |
| 87 | * core can touch this. | 87 | * core can touch this. |
| 88 | * @p_cb: Callbacks private to the driver core; no one other than the | ||
| 89 | * driver core is allowed to touch this. | ||
| 88 | * | 90 | * |
| 89 | * The device driver-model tracks all of the drivers known to the system. | 91 | * The device driver-model tracks all of the drivers known to the system. |
| 90 | * The main reason for this tracking is to enable the driver core to match | 92 | * The main reason for this tracking is to enable the driver core to match |
| @@ -119,6 +121,13 @@ struct device_driver { · 28 unmodified lines | |||
| 119 | void (*coredump) (struct device *dev); | 121 | void (*coredump) (struct device *dev); |
| 120 | 122 | ||
| 121 | struct driver_private *p; | 123 | struct driver_private *p; |
| 124 | struct { | ||
| 125 | /* | ||
| 126 | * Called after remove() and after all devres entries have been | ||
| 127 | * processed. This is a Rust only callback. | ||
| 128 | */ | ||
| 129 | void (*post_unbind_rust)(struct device *dev); | ||
| 130 | } p_cb; | ||
| 122 | }; | 131 | }; |
| 123 | 132 | ||
| 124 | 133 | ||