Re: [PATCH v3 07/14] gpu: nova-core: add an interrupt delivery self-test

[John Hubbard]

On 9/2/26 8:29 PM, sashiko-bot@xxxxxxxxxx wrote:
...
>> @@ -330,6 +337,12 @@ pub(crate) fn new<'a>(
>>          let dev = pdev.as_ref();
>>  
>>          try_pin_init!(Self {
>> +            vectors: crate::irq::alloc_vectors(pdev, crate::irq::SERVICED_SUBTREE.into())?,
>> +
>> +            // SAFETY: `vectors` is initialized above, lives at a pinned stable address, and is
>> +            // dropped after every field that uses `vectors_ref` (struct field drop order).
>> +            vectors_ref: unsafe { &*core::ptr::from_ref(vectors.as_ref().get_ref()) },
> 
> [Severity: High]
> Does this create a dangling pointer under the Rust memory model?

Probably not. Perhaps Sashiko doesn't know about pin_init yet. :)


> 
> `try_pin_init!` provides access to previously initialized fields via local
> variable bindings, which expire at the end of the initialization closure.
> Taking a reference from this local variable and artificially extending its
> lifetime to `'gpu` via `unsafe { &*... }` violates strict aliasing rules
> (Stacked Borrows / Tree Borrows).
> 
> When the closure returns, the local variable goes out of scope, its
> provenance tag is popped, and `vectors_ref` becomes a dangling pointer.
> The `pin-init` crate also explicitly documents that creating references to
> fields of the struct inside the initializer is not allowed.
> 
>> +
>>              spec: Spec::new(dev, bar).inspect(|spec| {
>>                  dev_info!(dev,"NVIDIA ({})\n", spec);
>>              })?,
> 

thanks,
-- 
John Hubbard