Re: cdev/devm_* issues (was Re: [TECH TOPIC] Rust for Linux)

[Dan Carpenter <dan.carpenter@oracle.com>]

On Thu, Jul 15, 2021 at 11:54:22AM +0200, Daniel Vetter wrote:
> Since we're dropping notes, a few of my thoughts:
> 
> - Personally I think an uapi resource cleanup system needs a different
> namespace, so that you don't mix these up. Hence drmm_ vs devres_ for
> drm, and maybe the generic version could be called uapires or ures or
> whatever. It needs to stick out.
> 
> - I'm wondering whether we could enlist checkers (maybe a runtime one)
> to scream anytime we do an unprotected dereference from ures memory to
> devres memory. This would help in subsystem where this problem is
> solved by trying to decouple the uapi side from the device side (like
> gpio and other subsystem with simpler interfaces). We have undefined
> behaviour and data race checkers already, this should be doable. But I
> have no idea how :-)

So you want a warning with code like:

	p->foo = bar;

Where "p" is devres memory and "bar" is ures?  There are a couple
approaches you could take and I would advise to implement both.

The first approach is to just check directly for if p is devres and bar
is ures.  The problem is that sometimes you won't know if p is devres so
some bugs will be missed.

The second approach is to say something like if we find one type "p"
that is devres, then let's assume they all are.  Same for ures.  Then
based on our assumptions about types, print a warning if they don't
match.  Then go through the warnings and make a list of types which lead
to false positives and add it to smatch_data/kernel.ignore_devres_types.
This is a bit hand wavey but that's basically the approach.

A third approach would be to do something with manual annotations.  You
could probably make Sparse work for something like that.

regards,
dan carpenter