From a4aaec5580d8fb0b89b03ad7b95f5f52ce2b23e6 Mon Sep 17 00:00:00 2001 From: Georgios Androutsopoulos Date: Thu, 10 Sep 2026 11:38:44 -0400 Subject: [PATCH] rust: auxiliary: validate DeviceId name length `DeviceId::new()` copies `modname` and `name` into the fixed 40-byte `auxiliary_device_id::name` array without checking that they fit. An oversized name is caught by the array bounds check, but the error reports an out-of-bounds index in the copy loop rather than the constraint the caller violated. Check the invariant explicitly instead, so the failure states the length limit rather than an array index. This should only be reached when constructing a device ID table, so the failure is a compile time error. Document that intent. Signed-off-by: Georgios Androutsopoulos Reviewed-by: Alexandre Courbot Link: https://patch.msgid.link/20260910153844.3987791-1-georgeandrout13@gmail.com Signed-off-by: Danilo Krummrich --- rust/kernel/auxiliary.rs | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/rust/kernel/auxiliary.rs b/rust/kernel/auxiliary.rs index 60dfbec8f330..2ace0428e45e 100644 --- a/rust/kernel/auxiliary.rs +++ b/rust/kernel/auxiliary.rs @@ -137,10 +137,18 @@ macro_rules! module_auxiliary_driver { impl DeviceId { /// Create a new [`DeviceId`] from name. + /// + /// This is only intended to be called in const context, when constructing a + /// device ID table, where exceeding `AUXILIARY_NAME_SIZE` is a compile time error. pub const fn new(modname: &'static CStr, name: &'static CStr) -> Self { let name = name.to_bytes_with_nul(); let modname = modname.to_bytes_with_nul(); + assert!( + modname.len().saturating_add(name.len()) <= bindings::AUXILIARY_NAME_SIZE as usize, + "auxiliary device ID is too long" + ); + let mut id: bindings::auxiliary_device_id = pin_init::zeroed(); let mut i = 0; while i < modname.len() {