On Mon, Apr 1, 2024 at 8:53 PM Benno Lossin <benno.lossin@xxxxxxxxx> wrote: > > The `module!` macro creates glue code that are called by C to initialize > the Rust modules using the `Module::init` function. Part of this glue > code are the local functions `__init` and `__exit` that are used to > initialize/destroy the Rust module. > These functions are safe and also visible to the Rust mod in which the > `module!` macro is invoked. This means that they can be called by other > safe Rust code. But since they contain `unsafe` blocks that rely on only > being called at the right time, this is a soundness issue. > > Wrap these generated functions inside of two private modules, this > guarantees that the public functions cannot be called from the outside. > Make the safe functions `unsafe` and add SAFETY comments. > > Cc: stable@xxxxxxxxxxxxxxx > Closes: https://github.com/Rust-for-Linux/linux/issues/629 > Fixes: 1fbde52bde73 ("rust: add `macros` crate") > Signed-off-by: Benno Lossin <benno.lossin@xxxxxxxxx> [ Capitalized comments, avoided newline in non-list SAFETY comments and reworded to add Reported-by and newline. ] Applied to `rust-fixes` -- thanks everyone! Cheers, Miguel
