From 2e8bac09ed6d7aa2ad4e8a9a6cba67e5835865c2 Mon Sep 17 00:00:00 2001 From: Priya Bala Govindasamy Date: Wed, 23 Sep 2026 20:31:45 +0000 Subject: rust: module_param: Fix potentially incorrect access of `SetOnce` The `set_param` function casts `kernel_param.arg` to `*const SetOnce` But the Rust module macro in rust/macros/module.rs initializes `arg` with `#param_name.as_void_ptr()`, and `#param_name` is a `ModuleParamAccess`, not a `SetOnce`. ModuleParamAccess has default Rust layout but `set_param` accesses its first field SetOnce assuming it to be at offset 0. This is not guaranteed by Rust and could cause type confusion leading to data corruption. Fix this by casting `kernel_param.arg` to `ModuleParamAccess` and then accessing the `value: SetOnce` field. Fixes: 0b08fc292842 ("rust: introduce module_param module") Cc: stable@vger.kernel.org Reported-by: Dylan Zueck Assisted-by: LLM Suggested-by: Andreas Hindborg Signed-off-by: Priya Bala Govindasamy Signed-off-by: Petr Pavlu --- rust/kernel/module_param.rs | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'rust/kernel/module_param.rs') diff --git a/rust/kernel/module_param.rs b/rust/kernel/module_param.rs index f9a14765a926..1a2fcbf4a5b3 100644 --- a/rust/kernel/module_param.rs +++ b/rust/kernel/module_param.rs @@ -74,8 +74,13 @@ where crate::error::from_result(|| { let new_value = T::try_from_param_arg(arg)?; - // SAFETY: By function safety requirements, this access is safe. - let container = unsafe { &*((*param).__bindgen_anon_1.arg.cast::>()) }; + // SAFETY: By function safety requirements, `param` is valid for read. + let arg = unsafe { (*param).__bindgen_anon_1.arg }; + let param_access_ptr = arg.cast::>(); + // SAFETY: The `arg` field is initialized with a pointer to a `static ModuleAccessParam` by + // the rust module macro. Thus, the pointer is valid for use as a reference. + let param_access = unsafe { &*(param_access_ptr) }; + let container = ¶m_access.value; container .populate(new_value) -- cgit v1.2.3