linux-kernel - [PATCH 1/2] rust: sync: require `Send` and `Sync` for `Backend::State`

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240903091700.172734-1-benno.lossin@proton.me>
Date: Tue, 03 Sep 2024 09:17:10 +0000
From: Benno Lossin <benno.lossin@...ton.me>
To: Miguel Ojeda <ojeda@...nel.org>, Alex Gaynor <alex.gaynor@...il.com>, Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>, Björn Roy Baron <bjorn3_gh@...tonmail.com>, Benno Lossin <benno.lossin@...ton.me>, Andreas Hindborg <a.hindborg@...sung.com>, Alice Ryhl <aliceryhl@...gle.com>
Cc: rust-for-linux@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH 1/2] rust: sync: require `Send` and `Sync` for `Backend::State`

`Lock<T, B>` implements `Send` and `Sync` when `T` is `Send` or `Sync`
respectively. Since this does not depend on `B`, creating a `Lock` that
is `Send` and `Sync`, but with a `!Sync` or `!Send` state is possible.
This is a soundness issue, thus add the bounds to the respective impls.

Signed-off-by: Benno Lossin <benno.lossin@...ton.me>
---
 rust/kernel/sync/lock.rs | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/rust/kernel/sync/lock.rs b/rust/kernel/sync/lock.rs
index f6c34ca4d819..e73ac9d97b29 100644
--- a/rust/kernel/sync/lock.rs
+++ b/rust/kernel/sync/lock.rs
@@ -97,12 +97,23 @@ pub struct Lock<T: ?Sized, B: Backend> {
     pub(crate) data: UnsafeCell<T>,
 }
 
-// SAFETY: `Lock` can be transferred across thread boundaries iff the data it protects can.
-unsafe impl<T: ?Sized + Send, B: Backend> Send for Lock<T, B> {}
+// SAFETY: `Lock` can be transferred across thread boundaries iff the data it protects and the
+// backend state can.
+unsafe impl<T: ?Sized, B: Backend> Send for Lock<T, B>
+where
+    T: Send,
+    B::State: Send,
+{
+}
 
 // SAFETY: `Lock` serialises the interior mutability it provides, so it is `Sync` as long as the
-// data it protects is `Send`.
-unsafe impl<T: ?Sized + Send, B: Backend> Sync for Lock<T, B> {}
+// data it protects is `Send` and the backend state can be shared.
+unsafe impl<T: ?Sized + Send, B: Backend> Sync for Lock<T, B>
+where
+    T: Send,
+    B::State: Sync,
+{
+}
 
 impl<T, B: Backend> Lock<T, B> {
     /// Constructs a new lock initialiser.

base-commit: a335e95914046c6bed45c0d17cabcd483682cf5e
-- 
2.46.0