Message-ID: <20250314034910.134463-1-christiansantoslima21@gmail.com>
Date: Fri, 14 Mar 2025 00:49:10 -0300
From: christian <christiansantoslima21@...il.com>
To: rust-for-linux@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Miguel Ojeda <ojeda@...nel.org>,
	Alex Gaynor <alex.gaynor@...il.com>,
	Boqun Feng <boqun.feng@...il.com>,
	Gary Guo <gary@...yguo.net>,
	Björn Roy Baron <bjorn3_gh@...tonmail.com>,
	Benno Lossin <benno.lossin@...ton.me>,
	Andreas Hindborg <a.hindborg@...nel.org>,
	Alice Ryhl <aliceryhl@...gle.com>,
	Trevor Gross <tmgross@...ch.edu>,
	Danilo Krummrich <dakr@...nel.org>,
	~lkcamp/patches@...ts.sr.ht,
	richard120310@...il.com
Subject: [PATCH v4] Add methods for FromBytes trait.

Methods receive a slice and perform size check to add
a valid way to make conversion safe.
In the invalid case return the EINVAL error.

The conversion between slices ([T])
is separated from others, because I couldn't implement it
in the same way as the other conversions.

Link: https://github.com/Rust-for-Linux/linux/issues/1119
Signed-off-by: christian <christiansantoslima21@...il.com>
---
 rust/kernel/transmute.rs | 67 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 64 insertions(+), 3 deletions(-)

diff --git a/rust/kernel/transmute.rs b/rust/kernel/transmute.rs
index 1c7d43771a37..5924c0daccfc 100644
--- a/rust/kernel/transmute.rs
+++ b/rust/kernel/transmute.rs
@@ -2,6 +2,8 @@
 
 //! Traits for transmuting types.
 
+use crate::prelude::{Error, EINVAL};
+
 /// Types for which any bit pattern is valid.
 ///
 /// Not all types are valid for all values. For example, a `bool` must be either zero or one, so
@@ -12,26 +14,85 @@
 /// # Safety
 ///
 /// All bit-patterns must be valid for this type. This type must not have interior mutability.
-pub unsafe trait FromBytes {}
+///
+/// # Example
+///
+/// ```
+/// let foo = &[1, 2, 3, 4];
+///
+/// let result = u8::from_bytes(foo);
+///
+/// assert_eq!(*result, 0x40300201);
+/// ```
+pub trait FromBytes {
+    /// Receives a slice of bytes and converts to a valid reference of Self when it's possible.
+    fn from_bytes(slice_of_bytes: &[u8]) -> Result<&Self, Error>;
+
+    /// Receives a mutable slice of bytes and converts to a valid reference of Self when it's possible.
+    fn from_bytes_mut(mut_slice_of_bytes: &mut [u8]) -> Result<&mut Self, Error>;
+}
 
 macro_rules! impl_frombytes {
     ($($({$($generics:tt)*})? $t:ty, )*) => {
         // SAFETY: Safety comments written in the macro invocation.
-        $(unsafe impl$($($generics)*)? FromBytes for $t {})*
+        $(impl$($($generics)*)? FromBytes for $t {
+            fn from_bytes(slice_of_bytes: &[u8]) -> Result<&$t, Error> {
+                if slice_of_bytes.len() == core::mem::size_of::<$t>() {
+                    let slice_ptr = slice_of_bytes.as_ptr() as *const $t;
+                    unsafe { Ok(&*slice_ptr) }
+                } else {
+                    Err(EINVAL)
+                }
+            }
+
+            fn from_bytes_mut(mut_slice_of_bytes: &mut [u8]) -> Result<&mut $t, Error> {
+                if mut_slice_of_bytes.len() == core::mem::size_of::<$t>() {
+                    let slice_ptr = mut_slice_of_bytes.as_mut_ptr() as *mut $t;
+                    unsafe { Ok(&mut *slice_ptr) }
+                } else {
+                    Err(EINVAL)
+                }
+            }
+        })*
     };
 }
 
 impl_frombytes! {
     // SAFETY: All bit patterns are acceptable values of the types below.
+    // SAFETY: Dereferencing the pointer is safe because slice has the same size of Self.
     u8, u16, u32, u64, usize,
     i8, i16, i32, i64, isize,
 
     // SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
     // patterns are also acceptable for arrays of that type.
-    {<T: FromBytes>} [T],
+    // SAFETY: Dereferencing the pointer is safe because slice has the same size of Self.
     {<T: FromBytes, const N: usize>} [T; N],
 }
 
+impl<T: FromBytes> FromBytes for [T] {
+    fn from_bytes(slice_of_bytes: &[u8]) -> Result<&Self, Error> {
+        let slice_ptr = slice_of_bytes.as_ptr() as *const T;
+        if slice_of_bytes.len() % core::mem::size_of::<T>() == 0 {
+            let slice_len = slice_of_bytes.len() / core::mem::size_of::<T>();
+            // SAFETY: Creating a slice is safe because the slice can be divided into T sized blocks.
+            unsafe { Ok(core::slice::from_raw_parts(slice_ptr, slice_len)) }
+        } else {
+            Err(EINVAL)
+        }
+    }
+
+    fn from_bytes_mut(mut_slice_of_bytes: &mut [u8]) -> Result<&mut Self, Error> {
+        let slice_ptr = mut_slice_of_bytes.as_mut_ptr() as *mut T;
+        if mut_slice_of_bytes.len() % core::mem::size_of::<T>() == 0 {
+            let slice_len = mut_slice_of_bytes.len() / core::mem::size_of::<T>();
+            // SAFETY: Creating a slice is safe because the slice can be divided into T sized blocks.
+            unsafe { Ok(core::slice::from_raw_parts_mut(slice_ptr, slice_len)) }
+        } else {
+            Err(EINVAL)
+        }
+    }
+}
+
 /// Types that can be viewed as an immutable slice of initialized bytes.
 ///
 /// If a struct implements this trait, then it is okay to copy it byte-for-byte to userspace. This
-- 
2.48.1

Powered by blists - more mailing lists