From 2a1be40c7ae5607cb84359f9638df92ee41bc860 Mon Sep 17 00:00:00 2001
From: Daniel Levin <daniel.levin@oxidecomputer.com>
Date: Tue, 30 Jun 2026 14:09:33 +0000
Subject: [PATCH] [safety] Weaken lifetime in get_xde_state()

The pointer we get back from ddi_get_driver_private
assuredly does not have a static lifetime. In practice,
this was unlikely to lead to bugs. But, by weakening
the promise we make to the compiler, we can prevent
unsound optimizations before the compiler makes them,
or before we accidentally induce the compiler to make them.

Signed-off-by: Daniel Levin <daniel.levin@oxidecomputer.com>
---
 xde/src/xde.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xde/src/xde.rs b/xde/src/xde.rs
index 2c814957..7587ed79 100644
--- a/xde/src/xde.rs
+++ b/xde/src/xde.rs
@@ -569,7 +569,7 @@ struct UnderlayState {
     shared_props: OffloadInfo,
 }
 
-fn get_xde_state() -> &'static XdeState {
+fn get_xde_state<'a>() -> &'a XdeState {
     // Safety: The opte_dip pointer is write-once and is a valid
     // pointer passed to attach(9E). The returned pointer is valid as
     // it was derived from Box::into_raw() during `xde_attach`.