Skip to content

Commit 690c9b4

Browse files
jannaujannau
committed
Revert "rust: macros: fix soundness issue in module! macro"
This reverts commit 7044dcf. Signed-off-by: Janne Grunau <j@jannau.net>
1 parent b4aeb2d commit 690c9b4

1 file changed

Lines changed: 76 additions & 116 deletions

File tree

‎rust/macros/module.rs‎

Lines changed: 76 additions & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -544,6 +544,17 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream {
544544
/// Used by the printing macros, e.g. [`info!`].
545545
const __LOG_PREFIX: &[u8] = b\"{name}\\0\";
546546
547+
/// The \"Rust loadable module\" mark.
548+
//
549+
// This may be best done another way later on, e.g. as a new modinfo
550+
// key or a new section. For the moment, keep it simple.
551+
#[cfg(MODULE)]
552+
#[doc(hidden)]
553+
#[used]
554+
static __IS_RUST_MODULE: () = ();
555+
556+
static mut __MOD: Option<{type_}> = None;
557+
547558
// SAFETY: `__this_module` is constructed by the kernel at load time and will not be
548559
// freed until the module is unloaded.
549560
#[cfg(MODULE)]
@@ -559,133 +570,82 @@ pub(crate) fn module(ts: TokenStream) -> TokenStream {
559570
kernel::ThisModule::from_ptr(core::ptr::null_mut())
560571
}};
561572
562-
// Double nested modules, since then nobody can access the public items inside.
563-
mod __module_init {{
564-
mod __module_init {{
565-
use super::super::{type_};
566-
567-
/// The \"Rust loadable module\" mark.
568-
//
569-
// This may be best done another way later on, e.g. as a new modinfo
570-
// key or a new section. For the moment, keep it simple.
571-
#[cfg(MODULE)]
572-
#[doc(hidden)]
573-
#[used]
574-
static __IS_RUST_MODULE: () = ();
575-
576-
static mut __MOD: Option<{type_}> = None;
577-
578-
// Loadable modules need to export the `{{init,cleanup}}_module` identifiers.
579-
/// # Safety
580-
///
581-
/// This function must not be called after module initialization, because it may be
582-
/// freed after that completes.
583-
#[cfg(MODULE)]
584-
#[doc(hidden)]
585-
#[no_mangle]
586-
#[link_section = \".init.text\"]
587-
pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{
588-
// SAFETY: This function is inaccessible to the outside due to the double
589-
// module wrapping it. It is called exactly once by the C side via its
590-
// unique name.
591-
unsafe {{ __init() }}
592-
}}
573+
// Loadable modules need to export the `{{init,cleanup}}_module` identifiers.
574+
/// # Safety
575+
///
576+
/// This function must not be called after module initialization, because it may be
577+
/// freed after that completes.
578+
#[cfg(MODULE)]
579+
#[doc(hidden)]
580+
#[no_mangle]
581+
#[link_section = \".init.text\"]
582+
pub unsafe extern \"C\" fn init_module() -> core::ffi::c_int {{
583+
__init()
584+
}}
593585
594-
#[cfg(MODULE)]
595-
#[doc(hidden)]
596-
#[no_mangle]
597-
pub extern \"C\" fn cleanup_module() {{
598-
// SAFETY:
599-
// - This function is inaccessible to the outside due to the double
600-
// module wrapping it. It is called exactly once by the C side via its
601-
// unique name,
602-
// - furthermore it is only called after `init_module` has returned `0`
603-
// (which delegates to `__init`).
604-
unsafe {{ __exit() }}
605-
}}
586+
#[cfg(MODULE)]
587+
#[doc(hidden)]
588+
#[no_mangle]
589+
pub extern \"C\" fn cleanup_module() {{
590+
__exit()
591+
}}
606592
607-
// Built-in modules are initialized through an initcall pointer
608-
// and the identifiers need to be unique.
609-
#[cfg(not(MODULE))]
610-
#[cfg(not(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS))]
611-
#[doc(hidden)]
612-
#[link_section = \"{initcall_section}\"]
613-
#[used]
614-
pub static __{name}_initcall: extern \"C\" fn() -> core::ffi::c_int = __{name}_init;
615-
616-
#[cfg(not(MODULE))]
617-
#[cfg(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)]
618-
core::arch::global_asm!(
619-
r#\".section \"{initcall_section}\", \"a\"
620-
__{name}_initcall:
621-
.long __{name}_init - .
622-
.previous
623-
\"#
624-
);
625-
626-
#[cfg(not(MODULE))]
627-
#[doc(hidden)]
628-
#[no_mangle]
629-
pub extern \"C\" fn __{name}_init() -> core::ffi::c_int {{
630-
// SAFETY: This function is inaccessible to the outside due to the double
631-
// module wrapping it. It is called exactly once by the C side via its
632-
// placement above in the initcall section.
633-
unsafe {{ __init() }}
634-
}}
593+
// Built-in modules are initialized through an initcall pointer
594+
// and the identifiers need to be unique.
595+
#[cfg(not(MODULE))]
596+
#[cfg(not(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS))]
597+
#[doc(hidden)]
598+
#[link_section = \"{initcall_section}\"]
599+
#[used]
600+
pub static __{name}_initcall: extern \"C\" fn() -> core::ffi::c_int = __{name}_init;
635601
636-
#[cfg(not(MODULE))]
637-
#[doc(hidden)]
638-
#[no_mangle]
639-
pub extern \"C\" fn __{name}_exit() {{
640-
// SAFETY:
641-
// - This function is inaccessible to the outside due to the double
642-
// module wrapping it. It is called exactly once by the C side via its
643-
// unique name,
644-
// - furthermore it is only called after `__{name}_init` has returned `0`
645-
// (which delegates to `__init`).
646-
unsafe {{ __exit() }}
647-
}}
602+
#[cfg(not(MODULE))]
603+
#[cfg(CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)]
604+
core::arch::global_asm!(
605+
r#\".section \"{initcall_section}\", \"a\"
606+
__{name}_initcall:
607+
.long __{name}_init - .
608+
.previous
609+
\"#
610+
);
648611
649-
/// # Safety
650-
///
651-
/// This function must only be called once.
652-
unsafe fn __init() -> core::ffi::c_int {{
653-
match <{type_} as kernel::Module>::init(kernel::c_str!(\"{name}\"), &THIS_MODULE) {{
654-
Ok(m) => {{
655-
// SAFETY: No data race, since `__MOD` can only be accessed by this
656-
// module and there only `__init` and `__exit` access it. These
657-
// functions are only called once and `__exit` cannot be called
658-
// before or during `__init`.
659-
unsafe {{
660-
__MOD = Some(m);
661-
}}
662-
return 0;
663-
}}
664-
Err(e) => {{
665-
return e.to_errno();
666-
}}
667-
}}
668-
}}
612+
#[cfg(not(MODULE))]
613+
#[doc(hidden)]
614+
#[no_mangle]
615+
pub extern \"C\" fn __{name}_init() -> core::ffi::c_int {{
616+
__init()
617+
}}
669618
670-
/// # Safety
671-
///
672-
/// This function must
673-
/// - only be called once,
674-
/// - be called after `__init` has been called and returned `0`.
675-
unsafe fn __exit() {{
676-
// SAFETY: No data race, since `__MOD` can only be accessed by this module
677-
// and there only `__init` and `__exit` access it. These functions are only
678-
// called once and `__init` was already called.
619+
#[cfg(not(MODULE))]
620+
#[doc(hidden)]
621+
#[no_mangle]
622+
pub extern \"C\" fn __{name}_exit() {{
623+
__exit()
624+
}}
625+
626+
fn __init() -> core::ffi::c_int {{
627+
match <{type_} as kernel::Module>::init(kernel::c_str!(\"{name}\"), &THIS_MODULE) {{
628+
Ok(m) => {{
679629
unsafe {{
680-
// Invokes `drop()` on `__MOD`, which should be used for cleanup.
681-
__MOD = None;
630+
__MOD = Some(m);
682631
}}
632+
return 0;
633+
}}
634+
Err(e) => {{
635+
return e.to_errno();
683636
}}
637+
}}
638+
}}
684639
685-
{modinfo}
686-
{generated_array_types}
640+
fn __exit() {{
641+
unsafe {{
642+
// Invokes `drop()` on `__MOD`, which should be used for cleanup.
643+
__MOD = None;
687644
}}
688645
}}
646+
647+
{modinfo}
648+
{generated_array_types}
689649
",
690650
type_ = info.type_,
691651
name = info.name,

0 commit comments

Comments
 (0)