Message-ID: <CAJ-ks9=-ZQpmhJRs3YstZBGb9UvLwRQJ7od+dsc_sYZtwUhF2A@mail.gmail.com>
Date: Wed, 12 Feb 2025 15:47:11 -0500
From: Tamir Duberstein <tamird@...il.com>
To: Danilo Krummrich <dakr@...nel.org>
Cc: Gary Guo <gary@...yguo.net>, Miguel Ojeda <ojeda@...nel.org>, DJ Delorie <dj@...hat.com>, 
	Eric Blake <eblake@...hat.com>, Paul Eggert <eggert@...ucla.edu>, 
	Alex Gaynor <alex.gaynor@...il.com>, Boqun Feng <boqun.feng@...il.com>, 
	Björn Roy Baron <bjorn3_gh@...tonmail.com>, 
	Benno Lossin <benno.lossin@...ton.me>, Andreas Hindborg <a.hindborg@...nel.org>, 
	Alice Ryhl <aliceryhl@...gle.com>, Trevor Gross <tmgross@...ch.edu>, rust-for-linux@...r.kernel.org, 
	linux-man@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v5] rust: alloc: satisfy POSIX alignment requirement

On Wed, Feb 12, 2025 at 3:01 PM Danilo Krummrich <dakr@...nel.org> wrote:
>
> On Wed, Feb 12, 2025 at 01:44:45PM -0500, Tamir Duberstein wrote:
> > On Wed, Feb 12, 2025 at 12:01 PM Danilo Krummrich <dakr@...nel.org> wrote:
> > >
> > > On Wed, Feb 12, 2025 at 04:38:48PM +0000, Gary Guo wrote:
> > > > On Wed, 12 Feb 2025 16:40:37 +0100
> > > > Danilo Krummrich <dakr@...nel.org> wrote:
> > > >
> > > > > On Wed, Feb 12, 2025 at 09:43:02AM -0500, Tamir Duberstein wrote:
> > > > > > diff --git a/rust/kernel/alloc/allocator_test.rs b/rust/kernel/alloc/allocator_test.rs
> > > > > > index e3240d16040b..17a475380253 100644
> > > > > > --- a/rust/kernel/alloc/allocator_test.rs
> > > > > > +++ b/rust/kernel/alloc/allocator_test.rs
> > > > > > @@ -62,6 +62,26 @@ unsafe fn realloc(
> > > > > >              ));
> > > > > >          }
> > > > > >
> > > > > > +        // ISO C (ISO/IEC 9899:2011) defines `aligned_alloc`:
> > > > > > +        //
> > > > > > +        // > The value of alignment shall be a valid alignment supported by the implementation
> > > > > > +        // [...].
> > > > > > +        //
> > > > > > +        // As an example of the "supported by the implementation" requirement, POSIX.1-2001 (IEEE
> > > > > > +        // 1003.1-2001) defines `posix_memalign`:
> > > > > > +        //
> > > > > > +        // > The value of alignment shall be a power of two multiple of sizeof (void *).
> > > > > > +        //
> > > > > > +        // and POSIX-based implementations of `aligned_alloc` inherit this requirement. At the time
> > > > > > +        // of writing, this is known to be the case on macOS (but not in glibc).
> > > > > > +        //
> > > > > > +        // Satisfy the stricter requirement to avoid spurious test failures on some platforms.
> > > > > > +        let min_align = core::mem::size_of::<*const crate::ffi::c_void>();
> > > > > > +        let layout = layout.align_to(min_align).unwrap_or_else(|_err| {
> > > > > > +            crate::build_error!("invalid alignment")
> > > > >
> > > > > That's not what I thought this patch will look like. I thought you'll directly
> > > > > follow Gary's proposal, which is why I said you can keep the ACK.
> > > > >
> > > > > build_error!() doesn't work here, there is no guarantee that this can be
> > > > > evaluated at compile time.
> > > >
> > > > `align_to` will only fail if `min_align` is not a valid alignment (i.e.
> > > > not power of two), which the compiler should be easy to notice that the
> > > > size of pointer is indeed power of 2.
> > >
> > > From the documentation of align_to():
> > >
> > > "Returns an error if the combination of self.size() and the given align violates
> > > the conditions listed in Layout::from_size_align."
> > >
> > > Formally self.size() may still be unknown at compile time.
> > >
> > > Do I miss anything?
> >
> > Formally, I agree. I tried testing (in allocator_test.rs):
> >
> > #[cfg(test)]
> > mod tests {
> >     use super::*;
> >
> >     #[test]
> >     fn test_allocate() {
> >         #[inline(never)]
> >         fn non_const_usize() -> usize {
> >             let x = 0;
> >             &x as *const _ as usize
> >         }
> >
> >         let layout = Layout::array::<bool>(non_const_usize()).unwrap();
> >         let ptr = Cmalloc::alloc(layout, GFP_KERNEL).unwrap();
> >         let ptr = ptr.cast();
> >         // SAFETY:
> >         // - `ptr` was previously allocated with `Cmalloc`.
> >         // - `layout` is equal to the `Layout´ `ptr` was allocated with.
> >         unsafe { Cmalloc::free(ptr, layout) };
> >     }
> > }
> >
> > and it compiled (and passed).
>
> I suggest to try the following.
>
> Move non_const_usize() into allocator_test.rs and within realloc(), try [1];
> then try [2].
>
> Besides that, I still think build_error!() can't be used here correctly, since
> layout.size() might not be known at compile time. Please change things to what I
> did suggest previously.
>
> --
>
> [1]
> ```
> if non_const_usize() < 0x42 {
>    crate::build_error!();
> }
> ```
>
> [2]
> ```
> if non_const_usize() >= 0x42 {
>    crate::build_error!();
> }
> ```

Quite a good experiment, thanks for suggesting it. The result is that
one of these just panics at run-time. This means that it's trivially
easy to hold `build_{assert,error}!()` incorrectly! It only does the
right thing in a constant context (and the docs do say this) but it's
very easy to use in _any_ context. Looks like I wasn't the only one to
fall into the trap (rust/kernel/io.rs):

    #[inline]
    const fn io_addr_assert<U>(&self, offset: usize) -> usize {
        build_assert!(Self::offset_valid::<U>(offset, SIZE));

        self.addr() + offset
    }

since offset isn't known at compile time, this can easily be misused?

I'll change this to map_err. Thanks for your scrutiny.

Powered by blists - more mailing lists