Re: [PATCH v6 01/13] rust: auxiliary: let registration_data_with() closures return covariant sub-fields

[Gary Guo]

On Wed Sep 9, 2026 at 7:44 AM BST, Alistair Popple wrote:
> The closure passed to registration_data_with() currently receives
> `Pin<&'a F::Of<'a>>` with `'a` universally quantified. This prevents the
> closure from returning references derived from the registration data,
> even for sub-fields that are covariant in their lifetime, because the
> compiler cannot relate `'a` to any lifetime the caller knows about.
>
> Tie the outer reference to the `&self` lifetime instead, i.e. pass
> `Pin<&'this F::Of<'a>>`. This gives the closure the implied bound
> `'a: 'this`, so covariant sub-fields such as `&'a T` can be coerced to
> `'this` and returned directly, while invariant fields still cannot be
> coerced and therefore cannot escape with an incorrect lifetime.
>
> This allows auxiliary child drivers to project covariant data out of
> invariant registration data without having to wrap every use in a
> closure.

Looking at this again I think the current API might be unsound where this patch
becomes fix rather than just a feature update.

For an invariant `&'b F::Of<'a>`, it's actually a requirement that `'a` strictly
outlive `'b`. With the current API surface, we can obtain a `&'a F::Of<'a>`,
then we can store it inside `F::Of<'a>` (because, well, F::Of<'a> being
invariant, it can internally have a `Mutex<Option<F::Of<'a>>`), and then we're
able to UAF within the destruction code of `F::Of<'a>`.

The fix, is, well, this patch.

Would you might pulling this patch out, rework the commit message a bit and send
as a standalone fix?

Best,
Gary

>
> Link: https://lore.kernel.org/nova-gpu/DL3WPTVM033J.33RWYCZOC67Z1@xxxxxxxxxx/
> Suggested-by: Gary Guo <gary@xxxxxxxxxxx>
> Co-developed-by: Danilo Krummrich <dakr@xxxxxxxxxx>
> Signed-off-by: Alistair Popple <apopple@xxxxxxxxxx>
>
> ---
>
> Changes since v5:
>
>  - New for v6
> ---
>  rust/kernel/auxiliary.rs | 17 +++++++++++------
>  1 file changed, 11 insertions(+), 6 deletions(-)
>
> diff --git a/rust/kernel/auxiliary.rs b/rust/kernel/auxiliary.rs
> index 60dfbec8f330..06f816420790 100644
> --- a/rust/kernel/auxiliary.rs
> +++ b/rust/kernel/auxiliary.rs
> @@ -305,6 +305,10 @@ unsafe fn registration_data_pinned<F: ForLt + 'static>(&self) -> Result<Pin<&F::
>      /// `F` is the [`ForLt`](trait@ForLt) encoding of the data type. The closure receives a pinned
>      /// reference to the registration data.
>      ///
> +    /// The outer reference carries the `&self` lifetime while the inner type carries the HRTB
> +    /// lifetime `'a`, implying `'a` outlives `&self`. This allows the closure to coerce covariant
> +    /// sub-fields (e.g. `&'a T` to the caller's lifetime) and return them directly in `R`.
> +    ///
>      /// For covariant types that implement [`trait@CovariantForLt`], prefer
>      /// [`registration_data`](Self::registration_data) which returns a direct reference.
>      ///
> @@ -314,13 +318,14 @@ unsafe fn registration_data_pinned<F: ForLt + 'static>(&self) -> Result<Pin<&F::
>      /// Returns [`ENOENT`] if no registration data has been set, e.g. when the device was
>      /// registered by a C driver.
>      #[inline]
> -    pub fn registration_data_with<F: ForLt + 'static, R>(
> -        &self,
> -        f: impl for<'a> FnOnce(Pin<&'a F::Of<'a>>) -> R,
> +    pub fn registration_data_with<'this, F: ForLt + 'static, R>(
> +        &'this self,
> +        f: impl for<'a> FnOnce(Pin<&'this F::Of<'a>>) -> R,
>      ) -> Result<R> {
> -        // SAFETY: The HRTB closure prevents the caller from smuggling in references with a
> -        // concrete short lifetime, making the round-trip from `'static` sound regardless of
> -        // variance.
> +        // SAFETY: The HRTB on the inner type prevents the caller from exploiting a specific
> +        // choice of `'a`. Covariant sub-fields can be safely coerced to `'this`, while
> +        // invariant fields cannot be coerced and thus cannot escape with an incorrect
> +        // lifetime.
>          let pinned = unsafe { self.registration_data_pinned::<F>()? };
>  
>          Ok(f(pinned))