Re: [PATCH v2 1/2] rust: add udelay() function

["Danilo Krummrich" <dakr@kernel.org>]

On Tue Oct 21, 2025 at 4:58 PM CEST, Miguel Ojeda wrote:
> On Tue, Oct 21, 2025 at 4:46 PM Danilo Krummrich <dakr@kernel.org> wrote:
>>
>> Given that we'd have a WARN() for any value passed that is > MAX_UDELAY_MS, and
>> given that WARN() is considered a vulnerability if hit (Greg, please correct me
>> if that's wrong), this would literally become a vulnerability generator. :)
>
> Yes, but only if hit in a way that can be triggered by an attacker,
> e.g. user actions, not in general.

Sure, that's what I assumed.

> i.e. that is why I was saying that someone could end up calculating a
> delay value based on something e.g. user controlled, and then gets an
> edge case wrong, and hits the `WARN()`, which is the "bad case" and a
> CVE would be assigned.
>
> A `pr_warn_once!` plus `debug_assert!` (or similar) should be a fine
> way for having EB in functions, which is a useful concept without
> leaving it UB liek in C nor going with a full `Result`. I can document
> that combo.

I'm not even sure we want that necessarily. I'd probably go for just documenting
that the value will be clamped to 0 <= value <= MAX_UDELAY_MS plus an internal
pr_debug!().

This way the function can also explicitly used in cases where the driver isn't
sure whether the value is in range and use it without duplicating the clamp
logic that the function already does internally anyways.