linux-kernel - Re: [PATCH v3 11/13] rust: init: make `PinInit<T, E>` a supertrait of `Init<T, E>`

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 6 Aug 2023 17:09:03 +0100
From:   Gary Guo <gary@...yguo.net>
To:     Benno Lossin <benno.lossin@...ton.me>
Cc:     Miguel Ojeda <ojeda@...nel.org>,
        Wedson Almeida Filho <wedsonaf@...il.com>,
        Alex Gaynor <alex.gaynor@...il.com>,
        Boqun Feng <boqun.feng@...il.com>,
        Björn Roy Baron <bjorn3_gh@...tonmail.com>,
        Alice Ryhl <aliceryhl@...gle.com>,
        Andreas Hindborg <nmi@...aspace.dk>,
        rust-for-linux@...r.kernel.org, linux-kernel@...r.kernel.org,
        Martin Rodriguez Reboredo <yakoyoku@...il.com>
Subject: Re: [PATCH v3 11/13] rust: init: make `PinInit<T, E>` a supertrait
 of `Init<T, E>`

On Sat, 29 Jul 2023 09:10:22 +0000
Benno Lossin <benno.lossin@...ton.me> wrote:

> Remove the blanket implementation of `PinInit<T, E> for I where I:
> Init<T, E>`. This blanket implementation prevented custom types that
> implement `PinInit`.
> 
> Reviewed-by: Martin Rodriguez Reboredo <yakoyoku@...il.com>
> Reviewed-by: Alice Ryhl <aliceryhl@...gle.com>
> Signed-off-by: Benno Lossin <benno.lossin@...ton.me>

Reviewed-by: Gary Guo <gary@...yguo.net>

> ---
> v2 -> v3:
> - add blank missing line,
> - added Reviewed-by's from Martin and Alice.
> 
>  rust/kernel/init.rs            | 21 ++++++++-------------
>  rust/kernel/init/__internal.rs | 12 ++++++++++++
>  2 files changed, 20 insertions(+), 13 deletions(-)
> 
> diff --git a/rust/kernel/init.rs b/rust/kernel/init.rs
> index 06ecab4901f2..040dc9a5f9fd 100644
> --- a/rust/kernel/init.rs
> +++ b/rust/kernel/init.rs
> @@ -807,7 +807,7 @@ pub unsafe trait PinInit<T: ?Sized, E = Infallible>: Sized {
>  ///
>  /// [`Arc<T>`]: crate::sync::Arc
>  #[must_use = "An initializer must be used in order to create its value."]
> -pub unsafe trait Init<T: ?Sized, E = Infallible>: Sized {
> +pub unsafe trait Init<T: ?Sized, E = Infallible>: PinInit<T, E> {
>      /// Initializes `slot`.
>      ///
>      /// # Safety
> @@ -818,18 +818,6 @@ pub unsafe trait Init<T: ?Sized, E = Infallible>: Sized {
>      unsafe fn __init(self, slot: *mut T) -> Result<(), E>;
>  }
>  
> -// SAFETY: Every in-place initializer can also be used as a pin-initializer.
> -unsafe impl<T: ?Sized, E, I> PinInit<T, E> for I
> -where
> -    I: Init<T, E>,
> -{
> -    unsafe fn __pinned_init(self, slot: *mut T) -> Result<(), E> {
> -        // SAFETY: `__init` meets the same requirements as `__pinned_init`, except that it does not
> -        // require `slot` to not move after init.
> -        unsafe { self.__init(slot) }
> -    }
> -}
> -
>  /// Creates a new [`PinInit<T, E>`] from the given closure.
>  ///
>  /// # Safety
> @@ -971,6 +959,13 @@ unsafe fn __init(self, slot: *mut T) -> Result<(), E> {
>      }
>  }
>  
> +// SAFETY: Every type can be initialized by-value. `__pinned_init` calls `__init`.
> +unsafe impl<T, E> PinInit<T, E> for T {
> +    unsafe fn __pinned_init(self, slot: *mut T) -> Result<(), E> {
> +        unsafe { self.__init(slot) }
> +    }
> +}
> +
>  /// Smart pointer that can initialize memory in-place.
>  pub trait InPlaceInit<T>: Sized {
>      /// Use the given pin-initializer to pin-initialize a `T` inside of a new smart pointer of this
> diff --git a/rust/kernel/init/__internal.rs b/rust/kernel/init/__internal.rs
> index 7abd1fb65e41..12e195061525 100644
> --- a/rust/kernel/init/__internal.rs
> +++ b/rust/kernel/init/__internal.rs
> @@ -32,6 +32,18 @@ unsafe fn __init(self, slot: *mut T) -> Result<(), E> {
>      }
>  }
>  
> +// SAFETY: While constructing the `InitClosure`, the user promised that it upholds the
> +// `__pinned_init` invariants.
> +unsafe impl<T: ?Sized, F, E> PinInit<T, E> for InitClosure<F, T, E>
> +where
> +    F: FnOnce(*mut T) -> Result<(), E>,
> +{
> +    #[inline]
> +    unsafe fn __pinned_init(self, slot: *mut T) -> Result<(), E> {
> +        (self.0)(slot)
> +    }
> +}
> +
>  /// This trait is only implemented via the `#[pin_data]` proc-macro. It is used to facilitate
>  /// the pin projections within the initializers.
>  ///