linux-kernel - Re: [PATCH v7 13/15] rust: types: add `Opaque::ffi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87h6tqs8kl.fsf@metaspace.dk>
Date:   Sat, 08 Apr 2023 17:21:19 +0200
From:   Andreas Hindborg <nmi@...aspace.dk>
To:     Benno Lossin <y86-dev@...tonmail.com>
Cc:     Miguel Ojeda <ojeda@...nel.org>,
        Alex Gaynor <alex.gaynor@...il.com>,
        Wedson Almeida Filho <wedsonaf@...il.com>,
        Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>,
        Björn Roy Baron <bjorn3_gh@...tonmail.com>,
        Alice Ryhl <alice@...l.io>, rust-for-linux@...r.kernel.org,
        linux-kernel@...r.kernel.org, patches@...ts.linux.dev,
        Alice Ryhl <aliceryhl@...gle.com>,
        Andreas Hindborg <a.hindborg@...sung.com>
Subject: Re: [PATCH v7 13/15] rust: types: add `Opaque::ffi_init`


Benno Lossin <y86-dev@...tonmail.com> writes:

> This function allows to easily initialize `Opaque` with the pin-init
> API. `Opaque::ffi_init` takes a closure and returns a pin-initializer.
> This pin-initiailizer calls the given closure with a pointer to the
> inner `T`.
>
> Co-developed-by: Gary Guo <gary@...yguo.net>
> Signed-off-by: Gary Guo <gary@...yguo.net>
> Signed-off-by: Benno Lossin <y86-dev@...tonmail.com>
> Cc: Alice Ryhl <aliceryhl@...gle.com>
> Cc: Andreas Hindborg <a.hindborg@...sung.com>
> ---

Reviewed-by: Andreas Hindborg <a.hindborg@...sung.com>

>  rust/kernel/init.rs  |  9 +++++++++
>  rust/kernel/types.rs | 20 ++++++++++++++++++++
>  2 files changed, 29 insertions(+)
>
> diff --git a/rust/kernel/init.rs b/rust/kernel/init.rs
> index ffd539e2f5ef..a1298c8bbda0 100644
> --- a/rust/kernel/init.rs
> +++ b/rust/kernel/init.rs
> @@ -177,6 +177,14 @@
>  //! }
>  //! ```
>  //!
> +//! For the special case where initializing a field is a single FFI-function call that cannot fail,
> +//! there exist the helper function [`Opaque::ffi_init`]. This function initialize a single
> +//! [`Opaque`] field by just delegating to the supplied closure. You can use these in combination
> +//! with [`pin_init!`].
> +//!
> +//! For more information on how to use [`pin_init_from_closure()`], take a look at the uses inside
> +//! the `kernel` crate. The [`sync`] module is a good starting point.
> +//!
>  //! [`sync`]: kernel::sync
>  //! [pinning]: https://doc.rust-lang.org/std/pin/index.html
>  //! [structurally pinned fields]:
> @@ -187,6 +195,7 @@
>  //! [`impl PinInit<T, E>`]: PinInit
>  //! [`impl Init<T, E>`]: Init
>  //! [`Opaque`]: kernel::types::Opaque
> +//! [`Opaque::ffi_init`]: kernel::types::Opaque::ffi_init
>  //! [`pin_data`]: ::macros::pin_data
>
>  use crate::{
> diff --git a/rust/kernel/types.rs b/rust/kernel/types.rs
> index ff2b2fac951d..3a46ec1a00cd 100644
> --- a/rust/kernel/types.rs
> +++ b/rust/kernel/types.rs
> @@ -2,6 +2,7 @@
>
>  //! Kernel types.
>
> +use crate::init::{self, PinInit};
>  use alloc::boxed::Box;
>  use core::{
>      cell::UnsafeCell,
> @@ -234,6 +235,25 @@ impl<T> Opaque<T> {
>          Self(MaybeUninit::uninit())
>      }
>
> +    /// Creates a pin-initializer from the given initializer closure.
> +    ///
> +    /// The returned initializer calls the given closure with the pointer to the inner `T` of this
> +    /// `Opaque`. Since this memory is uninitialized, the closure is not allowed to read from it.
> +    ///
> +    /// This function is safe, because the `T` inside of an `Opaque` is allowed to be
> +    /// uninitialized. Additionally, access to the inner `T` requires `unsafe`, so the caller needs
> +    /// to verify at that point that the inner value is valid.
> +    pub fn ffi_init(init_func: impl FnOnce(*mut T)) -> impl PinInit<Self> {
> +        // SAFETY: We contain a `MaybeUninit`, so it is OK for the `init_func` to not fully
> +        // initiailize the `T`.
> +        unsafe {
> +            init::pin_init_from_closure::<_, ::core::convert::Infallible>(move |slot| {
> +                init_func(Self::raw_get(slot));
> +                Ok(())
> +            })
> +        }
> +    }
> +
>      /// Returns a raw pointer to the opaque data.
>      pub fn get(&self) -> *mut T {
>          UnsafeCell::raw_get(self.0.as_ptr())