linux-kernel - Re: [PATCH v3 1/2] rust: kernel: add `drop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Zq5PVEZNcXHThNHB@boqun-archlinux>
Date: Sat, 3 Aug 2024 08:40:04 -0700
From: Boqun Feng <boqun.feng@...il.com>
To: Benno Lossin <benno.lossin@...ton.me>
Cc: Miguel Ojeda <ojeda@...nel.org>, Alex Gaynor <alex.gaynor@...il.com>,
	Wedson Almeida Filho <wedsonaf@...il.com>,
	Gary Guo <gary@...yguo.net>,
	Björn Roy Baron <bjorn3_gh@...tonmail.com>,
	Andreas Hindborg <a.hindborg@...sung.com>,
	Alice Ryhl <aliceryhl@...gle.com>, rust-for-linux@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3 1/2] rust: kernel: add `drop_contents` to `BoxExt`

On Sat, Aug 03, 2024 at 03:32:06PM +0000, Benno Lossin wrote:
> On 03.08.24 17:11, Boqun Feng wrote:
> > On Sat, Aug 03, 2024 at 02:23:42PM +0000, Benno Lossin wrote:
> >> On 03.08.24 16:16, Benno Lossin wrote:
> >>> @@ -53,4 +69,12 @@ fn new_uninit(flags: Flags) -> Result<Box<MaybeUninit<T>>, AllocError> {
> >>>          // zero-sized types, we use `NonNull::dangling`.
> >>>          Ok(unsafe { Box::from_raw(ptr) })
> >>>      }
> >>> +
> >>> +    fn drop_contents(this: Self) -> Box<MaybeUninit<T>> {
> >>> +        let ptr = Box::into_raw(this);
> >>> +        // SAFETY: `ptr` is valid, because it came from `Box::into_raw`.
> >>> +        unsafe { ptr::drop_in_place(ptr) };
> >>> +        // SAFETY: `ptr` is valid, because it came from `Box::into_raw`.
> >>
> >> I just noticed that I missed another comment from Boqun here. Got
> >> confused with the two mails. I would replace the comment above with
> >>
> >>     // CAST: `T` and `MaybeUninit<T>` have the same layout.
> >>     let ptr = ptr.cast::<MaybeUninit<T>>();
> >>     // SAFETY: `ptr` is valid for writes, because it came from `Box::into_raw` and it is valid for
> >>     // reads, since the pointer came from `Box::into_raw` and the type is `MaybeUninit<T>`.
> >>
> >> Let me know if you want another version.
> > 
> > Looks good to me, please do send an updated version.
> > 
> > Although, I would expect the "CAST" comment already explains that if
> > `ptr` is a valid, then the casting result is also valid, i.e. we put
> > "CAST" comments on the casting that matters to safety. But that seems
> > not matching what you use CAST for?
> 
> Well the pointer is no longer valid for reads, since the value has been
> dropped. Only through the cast, it becomes again read-valid.
> 

Fair enough, the past Boqun who made that suggestion might also realise
this and that's why he brought this up ;-)

> CAST comments must justify why the layouts are the same. On that note,
> this comment might be better:
> 
>     // CAST: `MaybeUninit<T>` is a transparent wrapper of `T`.
> 

Looks good to me.

Regards,
Boqun

> ---
> Cheers,
> Benno
>