linux-kernel - Re: [PATCH v4] rust: adding UniqueRefCounted and UniqueRef types

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z8hmCkeZGPwc5MuU@mango>
Date: Wed, 05 Mar 2025 14:56:15 +0000
From: Oliver Mangold <oliver.mangold@...me>
To: Alice Ryhl <aliceryhl@...gle.com>
Cc: Miguel Ojeda <ojeda@...nel.org>, Alex Gaynor <alex.gaynor@...il.com>, Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>, Björn Roy Baron <bjorn3_gh@...tonmail.com>, Benno Lossin <benno.lossin@...ton.me>, Andreas Hindborg <a.hindborg@...nel.org>, Trevor Gross <tmgross@...ch.edu>, rust-for-linux@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4] rust: adding UniqueRefCounted and UniqueRef types

Hi Alice,

On 250305 1339, Alice Ryhl wrote:
> On Wed, Mar 05, 2025 at 11:31:44AM +0000, Oliver Mangold wrote:
> 
> > +impl<T: UniqueRefCounted> Deref for UniqueRef<T> {
> > +    type Target = T;
> > +
> > +    fn deref(&self) -> &Self::Target {
> > +        // SAFETY: The type invariants guarantee that the object is valid.
> > +        unsafe { self.ptr.as_ref() }
> > +    }
> > +}
> 
> What stops people from doing this?
> 
> let my_unique: UniqueRef<T> = ...;
> let my_ref: &T = &*my_unique;
> let my_shared: ARef<T> = ARef::from(my_ref);
> 
> Now it is no longer unique.
>
Oh, indeed. That's a serious problem. I see 2 options to deal with that:

1. remove ARef::From<&T>

I checked the users of this, and it looks to me like there is rather
a limited number and they are easy to fix by replacing the &T with ARef<T>.
But I assume that wouldn't be welcome as it is intrusive nonetheless
and of course there is ergonomic value in having the function around.

2. add some new traits so implementers can opt in/out of that function.

Basically one would have to pick if one wants to ARef::From<&T> or
UniqueRef<T> for one's type.

> > +impl<T: UniqueRefCounted> DerefMut for UniqueRef<T> {
> > +    fn deref_mut(&mut self) -> &mut Self::Target {
> > +        // SAFETY: The type invariants guarantee that the object is valid.
> > +        unsafe { self.ptr.as_mut() }
> > +    }
> > +}
> 
> This DerefMut will make it almost impossible for C types to implement
> UniqueRefCounted because it is incompatible with pinning. You probably
> want `T: UniqueRefCounted + Unpin` here.
> 
> For `T: !Unpin` (i.e. almost all C types), you can at most produce an
> `Pin<&mut Self>`.

I think I only understand 70% of that incompatiblity, but I will do a
bit more reading.

In any case I think I can work around that, but doing as you say,
and maybe adding an extra method deref_pin() to get a pinned reference.

Best,

Oliver