linux-kernel - Re: C aggregate passing (Rust kernel policy)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANiq72=_krDaFaF4t2oCEQQGqO1Z7RrjxD7ZRSL79A4FCLwi=A@mail.gmail.com>
Date: Wed, 26 Feb 2025 18:11:53 +0100
From: Miguel Ojeda <miguel.ojeda.sandonis@...il.com>
To: James Bottomley <James.Bottomley@...senpartnership.com>
Cc: Ventura Jack <venturajack85@...il.com>, Kent Overstreet <kent.overstreet@...ux.dev>, 
	"H. Peter Anvin" <hpa@...or.com>, Alice Ryhl <aliceryhl@...gle.com>, 
	Linus Torvalds <torvalds@...ux-foundation.org>, Gary Guo <gary@...yguo.net>, airlied@...il.com, 
	boqun.feng@...il.com, david.laight.linux@...il.com, ej@...i.de, 
	gregkh@...uxfoundation.org, hch@...radead.org, ksummit@...ts.linux.dev, 
	linux-kernel@...r.kernel.org, rust-for-linux@...r.kernel.org, 
	Ralf Jung <post@...fj.de>
Subject: Re: C aggregate passing (Rust kernel policy)

On Wed, Feb 26, 2025 at 3:26 PM James Bottomley
<James.Bottomley@...senpartnership.com> wrote:
>
> On Wed, 2025-02-26 at 14:53 +0100, Miguel Ojeda wrote:
> > On Wed, Feb 26, 2025 at 2:03 PM Ventura Jack
> > <venturajack85@...il.com> wrote:
> [...]
> > > Exception/unwind safety may be another subject that increases
> > > the difficulty of writing unsafe Rust.
> >
> > Note that Rust panics in the kernel do not unwind.
>
> I presume someone is working on this, right?  While rust isn't
> pervasive enough yet for this to cause a problem, dumping a backtrace
> is one of the key things we need to diagnose how something went wrong,
> particularly for user bug reports where they can't seem to bisect.

Ventura Jack was talking about "exception safety", referring to the
complexity of having to take into account additional execution exit
paths that run destructors in the middle of doing something else and
the possibility of those exceptions getting caught. This does affect
Rust when built with the unwinding "panic mode", similar to C++.

In the kernel, we build Rust in its aborting "panic mode", which
simplifies reasoning about it, because destructors do not run and you
cannot catch exceptions (you could still cause mischief, though,
because it does not necessarily kill the kernel entirely, since it
maps to `BUG()` currently).

In other words, Ventura Jack and my message were not referring to
walking the frames for backtraces.

I hope that clarifies.

Cheers,
Miguel