| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <D8L494ONWVO6.1V6NNJIPG7UU9@proton.me>
Date: Thu, 20 Mar 2025 13:09:40 +0000
From: Benno Lossin <benno.lossin@...ton.me>
To: "Christian S. Lima" <christiansantoslima21@...il.com>, rust-for-linux@...r.kernel.org, linux-kernel@...r.kernel.org, Miguel Ojeda <ojeda@...nel.org>, Alex Gaynor <alex.gaynor@...il.com>, Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>, Björn Roy Baron <bjorn3_gh@...tonmail.com>, Andreas Hindborg <a.hindborg@...nel.org>, Alice Ryhl <aliceryhl@...gle.com>, Trevor Gross <tmgross@...ch.edu>, Danilo Krummrich <dakr@...nel.org>, ~lkcamp/patches@...ts.sr.ht, richard120310@...il.com
Subject: Re: [PATCH v5] rust: transmute: Add methods for FromBytes trait
On Thu Mar 20, 2025 at 2:40 AM CET, Christian S. Lima wrote:
> Methods receive a slice and perform size check to add
> a valid way to make conversion safe.
> In this patch, I use an Option, in error case just
> return `None` instead of an Error and
> removed some commentaries.
>
> The conversion between slices `[T]`
> is separated from others, because I couldn't implement it
> in the same way as the other conversions.
Why is this commit message wrapped like this?
>
> Link: https://github.com/Rust-for-Linux/linux/issues/1119
> Signed-off-by: Christian S. Lima <christiansantoslima21@...il.com>
> ---
> Changes in v2:
> - Rollback the implementation for the macro in the repository
> and implement methods in trai
> - Link to v2: https://lore.kernel.org/rust-for-linux/20241012193657.290cc79c@eugeo/T/#t
>
> Changes in v3:
> - Fix grammar errors
> - Remove repeated tests
> - Fix alignment errors
> - Fix tests not building
> - Link to v3: https://lore.kernel.org/rust-for-linux/20241109055442.85190-1-christiansantoslima21@gmail.com/
>
> Changes in v4:
> - Removed core::simd::ToBytes
> - Changed trait and methods to safe
> - Add Result<&Self, Error> in order to make safe methods
> - Link to v4: https://lore.kernel.org/rust-for-linux/20250314034910.134463-1-christiansantoslima21@gmail.com/
>
> - Link to v1: https://lore.kernel.org/rust-for-linux/20241009014810.23279-1-christiansantoslima21@gmail.com/
What changed in version 5? Or does "Changes in v4" mean "Changes done to
v4"?
> ---
> rust/kernel/transmute.rs | 74 +++++++++++++++++++++++++++++++++++++---
> 1 file changed, 69 insertions(+), 5 deletions(-)
>
> diff --git a/rust/kernel/transmute.rs b/rust/kernel/transmute.rs
> index 1c7d43771a37..5f2cf66187ad 100644
> --- a/rust/kernel/transmute.rs
> +++ b/rust/kernel/transmute.rs
> @@ -9,15 +9,53 @@
> ///
> /// It's okay for the type to have padding, as initializing those bytes has no effect.
> ///
> +/// # Example
> +/// ```
> +/// let foo = &[1, 2, 3, 4];
> +///
> +/// let result = u8::from_bytes(foo);
> +///
> +/// assert_eq!(*result, 0x40300201);
AFAIU this relies on the endianess of the architecture, I would check
the endianess in the test and then change the assertion based on that.
> +/// ```
> +///
> /// # Safety
> ///
> /// All bit-patterns must be valid for this type. This type must not have interior mutability.
> -pub unsafe trait FromBytes {}
> +pub unsafe trait FromBytes {
> + /// Receives a slice of bytes and converts to a valid reference of Self when it's possible.
/// Converts a slice of bytes to a reference to `Self` when possible.
> + fn from_bytes(bytes: &[u8]) -> Option<&Self>;
> +
> + /// Receives a mutable slice of bytes and converts to a valid reference of Self when it's possible.
Similarly here.
> + fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> + where
> + Self: AsBytes;
> +}
>
> macro_rules! impl_frombytes {
> ($($({$($generics:tt)*})? $t:ty, )*) => {
> // SAFETY: Safety comments written in the macro invocation.
> - $(unsafe impl$($($generics)*)? FromBytes for $t {})*
> + $(unsafe impl$($($generics)*)? FromBytes for $t {
> + fn from_bytes(bytes: &[u8]) -> Option<&$t> {
> + if bytes.len() == core::mem::size_of::<$t>() {
> + let slice_ptr = bytes.as_ptr() as *const $t;
Please use `.cast::<$t>()` instead of `as`.
> + unsafe { Some(&*slice_ptr) }
Missing safety comment.
> + } else {
> + None
> + }
> + }
> +
> + fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut $t>
> + where
> + Self: AsBytes,
> + {
> + if bytes.len() == core::mem::size_of::<$t>() {
> + let slice_ptr = bytes.as_mut_ptr() as *mut $t;
Please use `cast`.
> + unsafe { Some(&mut *slice_ptr) }
Missing safety comment.
> + } else {
> + None
> + }
> + }
> + })*
> };
> }
>
> @@ -26,12 +64,38 @@ macro_rules! impl_frombytes {
> u8, u16, u32, u64, usize,
> i8, i16, i32, i64, isize,
>
> - // SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
> - // patterns are also acceptable for arrays of that type.
> - {<T: FromBytes>} [T],
> {<T: FromBytes, const N: usize>} [T; N],
Missing SAFETY comment (the one that you remove above should still be
there).
> }
>
> +unsafe impl<T: FromBytes> FromBytes for [T] {
Missing SAFETY comment, you should copy the one from above.
> + fn from_bytes(bytes: &[u8]) -> Option<&Self> {
> + let slice_ptr = bytes.as_ptr() as *const T;
> + if bytes.len() % core::mem::size_of::<T>() == 0 {
> + let slice_len = bytes.len() / core::mem::size_of::<T>();
> + // SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
> + // patterns are also acceptable for arrays of that type.
This safety comment doesn't match the called function below.
> + unsafe { Some(core::slice::from_raw_parts(slice_ptr, slice_len)) }
> + } else {
> + None
> + }
> + }
> +
> + fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> + where
> + Self: AsBytes,
> + {
> + let slice_ptr = bytes.as_mut_ptr() as *mut T;
> + if bytes.len() % core::mem::size_of::<T>() == 0 {
> + let slice_len = bytes.len() / core::mem::size_of::<T>();
> + // SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
> + // patterns are also acceptable for arrays of that type.
Ditto.
---
Cheers,
Benno
> + unsafe { Some(core::slice::from_raw_parts_mut(slice_ptr, slice_len)) }
> + } else {
> + None
> + }
> + }
> +}
> +
> /// Types that can be viewed as an immutable slice of initialized bytes.
> ///
> /// If a struct implements this trait, then it is okay to copy it byte-for-byte to userspace. This
Powered by blists - more mailing lists