Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] rust: missing `# Safety` documentation for `unsafe fn new` exposing UAF on leak --
commit beab119634d6183863230115e35c006b11edee53 Author: Philipp Stanner <[email protected]> rust: DmaFence: remove static lifetime (will be upstreamed separately) > diff --git a/rust/kernel/dma_buf/dma_fence.rs > b/rust/kernel/dma_buf/dma_fence.rs > index 18a43e1bb442f..eef2b9e93f356 100644 > --- a/rust/kernel/dma_buf/dma_fence.rs > +++ b/rust/kernel/dma_buf/dma_fence.rs [ ... ] > @@ -326,7 +326,7 @@ impl<T: FenceCallback> FenceCallbackRegistration<T> { > /// On success the callback is pinned in place and will fire when the > fence > /// signals. On `AlreadySignaled` the callback is returned to the caller > so > /// that owned resources can be reclaimed. > - pub fn new<'a>(fence: &'a Fence, callback: T) -> impl PinInit<Self, > CallbackError<T>> + 'a > + pub unsafe fn new<'a>(fence: &'a Fence, callback: T) -> impl > PinInit<Self, CallbackError<T>> + 'a [Severity: Medium] Since this patch removes the 'static bound from FenceCallbackRegistration and makes FenceCallbackRegistration::new() unsafe to prevent callbacks from outliving their captured references, does this function also need a /// # Safety documentation block? According to the Rust coding guidelines, unsafe functions must document their safety preconditions. Without it, callers aren't explicitly informed of their obligation to prevent leaks (e.g. via core::mem::forget) which could bypass the Drop implementation and leave a dangling callback pointer that eventually causes a use-after-free when the fence signals. > where > T: 'a, > { -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
