Access That Can Be Taken Away
Hardware can disappear while your driver is still running: someone unplugs the card, or the device is unbound. Any pointer to its registers must then stop working, but code elsewhere may still hold a handle. A revocable wrapper solves this by making every use a short borrow that can fail: once the object is revoked, new attempts return nothing, and revocation waits for existing borrows to finish. It converts the hot-unplug use-after-free, a bug that is nearly impossible to test for in C, into an error branch you can see.
Questions this Concept answers
- Why does revocation wait for existing borrows to finish?
Revocable: an RCU-Based Mechanism for Preventing Use-After-Free Bugs in the Linux Kernel
Revocable is a synchronization mechanism, based on RCU/SRCU, for decoupling the lifecycle of a shared resource from the lifecycles of the independent consumers that access it. Instead of a dangling p…