freenode
Desktop & Graphics

Rust DRM fix stops crash when modules unload with devices open

Missing file_operations ownership in Rust DRM and misc helpers let the kernel call into unloaded code after rmmod.

A fix for the Linux kernel’s Rust DRM and miscdevice abstractions closes a gap that could crash the machine when a driver module was removed while userspace still held its device node open.

Alvin Sun hit the bug while working on the tyr driver: after rmmod tyr, gnome-shell still had /dev/card1 open, and the kernel took a NULL pointer dereference on a path that should have stayed pinned to the loaded module. The file_operations owner field is how the kernel tracks which module backs a character device. With it left null in the Rust helpers, nothing stopped the module from going away, and later ops ran into empty address space.

The series wires that owner from the driver’s module metadata into the DRM GEM and miscdevice file-operation tables, and refactors how Rust modules expose their ThisModule pointer so those tables can be filled in const contexts. Related call sites (including binder and configfs helpers) move to the same pattern so there is a single source of the module pointer instead of a leftover static.

For anyone shipping or testing out-of-tree Rust GPU or misc drivers, the practical effect is the expected one: open device fds keep the module referenced, and unload no longer races with compositor or other clients still talking to the node.