pub fn copy_from_iter_raw incorrectly elided output lifetime #1265

// SPDX-License-Identifier: GPL-2.0

//! PoC for the lifetime-elision hole in `IovIterSource::copy_from_iter_raw`
//! (`rust/kernel/iov.rs`).
//!
//! Build with `CONFIG_KASAN=y`; 

use core::mem::MaybeUninit;
use kernel::{bindings, iov, prelude::*};

module! {
    type: PocIov,
    name: "rfl_poc_iov",
    authors: ["spidermana"],
    description: "PoC: copy_from_iter_raw() returns a slice tied to &mut self, not to `out`",
    license: "GPL",
}

struct PocIov;

impl kernel::Module for PocIov {
    fn init(_module: &'static ThisModule) -> Result<Self> {
        match poc() {
            Ok(()) => pr_info!("POC: DONE\n"),
            Err(e) => pr_info!("POC: SKIPPED (setup failed: {:?})\n", e),
        }
        // Never fail init: the verdict is in the log, and a failed built-in initcall only adds
        // noise.
        Ok(PocIov)
    }
}

fn poc() -> Result {
    // Setup (C API): an ITER_SOURCE `iov_iter` reading from a buffer that outlives `it`.
    let src = [0x41u8; 32];
    let kv = bindings::kvec {
        iov_base: src.as_ptr().cast_mut().cast(),
        iov_len: src.len(),
    };
    let mut raw = MaybeUninit::<bindings::iov_iter>::zeroed();
    // SAFETY: `raw` is writable and `kv` describes one valid segment covering `src`.
    unsafe { bindings::iov_iter_kvec(raw.as_mut_ptr(), bindings::ITER_SOURCE, &kv, 1, src.len()) };
    // SAFETY: `raw` now holds a valid `ITER_SOURCE` iterator over `src`, which outlives `it`,
    // and nothing else touches `raw`.
    let it: &mut iov::IovIterSource<'_> = unsafe { iov::IovIterSource::from_raw(raw.as_mut_ptr()) };

    // =========================== SAFE RUST ===========================
    let dangling: &mut [u8] = {
        let mut buf = KVec::<u8>::with_capacity(32, GFP_KERNEL)?;
        it.copy_from_iter_raw(buf.spare_capacity_mut()) // <-- the hole: result is tied to `it`
        // `buf` (a 32-byte slab object) is kfree'd right here
    };
    pr_info!(
        "POC: holding &mut [u8] of len {} whose backing allocation is already freed\n",
        dangling.len()
    );
    pr_info!("POC: touching the dangling slice (write)\n");
    dangling.fill(0x42); // use-after-free write
    // =================================================================
    Ok(())
}

pub fn copy_from_iter_raw<'a>(&mut self, out: &'a mut [MaybeUninit<u8>]) -> &'a mut [u8]