| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAGSQo03teSsTa84Mx=4SFRAfa2=irBwgXXoh5eB_Q0RoixrF6Q@mail.gmail.com>
Date: Wed, 9 Apr 2025 16:01:21 -0700
From: Matthew Maurer <mmaurer@...gle.com>
To: "Christian S. Lima" <christiansantoslima21@...il.com>
Cc: rust-for-linux@...r.kernel.org, linux-kernel@...r.kernel.org,
Miguel Ojeda <ojeda@...nel.org>, Alex Gaynor <alex.gaynor@...il.com>,
Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>,
Björn Roy Baron <bjorn3_gh@...tonmail.com>,
Benno Lossin <benno.lossin@...ton.me>, Andreas Hindborg <a.hindborg@...nel.org>,
Alice Ryhl <aliceryhl@...gle.com>, Trevor Gross <tmgross@...ch.edu>,
Danilo Krummrich <dakr@...nel.org>, ~lkcamp/patches@...ts.sr.ht, richard120310@...il.com
Subject: Re: [PATCH v6] rust: transmute: Add methods for FromBytes trait
On Wed, Apr 9, 2025 at 3:32 PM Matthew Maurer <mmaurer@...gle.com> wrote:
>
> On Sun, Mar 30, 2025 at 4:40 PM Christian S. Lima
> <christiansantoslima21@...il.com> wrote:
> >
> > Methods receive a slice and perform size check to add a valid way to make
> > conversion safe. An Option is used, in error case just return `None`.
> >
> > The conversion between slices `[T]` is separated from others, because I
> > couldn't implement it in the same way as the other conversions.
> >
> > Link: https://github.com/Rust-for-Linux/linux/issues/1119
> > Signed-off-by: Christian S. Lima <christiansantoslima21@...il.com>
> > ---
> > Changes in v2:
> > - Rollback the implementation for the macro in the repository and implement
> > methods in trait
> > - Link to v2: https://lore.kernel.org/rust-for-linux/20241012193657.290cc79c@eugeo/T/#t
> >
> > Changes in v3:
> > - Fix grammar errors
> > - Remove repeated tests
> > - Fix alignment errors
> > - Fix tests not building
> > - Link to v3: https://lore.kernel.org/rust-for-linux/20241109055442.85190-1-christiansantoslima21@gmail.com/
> >
> > Changes in v4:
> > - Removed core::simd::ToBytes
> > - Changed trait and methods to safe Add
> > - Result<&Self, Error> in order to make safe methods
> > - Link to v4: https://lore.kernel.org/rust-for-linux/20250314034910.134463-1-christiansantoslima21@gmail.com/
> >
> > Changes in v5:
> > - Changed from Result to Option
> > - Removed commentaries
> > - Returned trait impl to unsafe
> > - Link to v5: https://lore.kernel.org/rust-for-linux/20250320014041.101470-1-christiansantoslima21@gmail.com/
> >
> > Changes in v6:
> > - Add endianess check to doc test and use match to check
> > success case
> > - Reformulated safety comments
> > ---
> > rust/kernel/transmute.rs | 89 +++++++++++++++++++++++++++++++++++++---
> > 1 file changed, 83 insertions(+), 6 deletions(-)
> >
> > diff --git a/rust/kernel/transmute.rs b/rust/kernel/transmute.rs
> > index 1c7d43771a37..16dfa5c7d467 100644
> > --- a/rust/kernel/transmute.rs
> > +++ b/rust/kernel/transmute.rs
> > @@ -9,29 +9,106 @@
> > ///
> > /// It's okay for the type to have padding, as initializing those bytes has no effect.
> > ///
> > +/// # Example
> > +/// ```
> > +/// let foo = &[1, 2, 3, 4];
> > +///
> > +/// let result = u32::from_bytes(foo);
> > +///
> > +/// #[cfg(target_endian = "little")]
> > +/// match result {
> > +/// Some(x) => assert_eq!(*x, 0x4030201),
> > +/// None => unreachable!()
> > +/// }
> > +///
> > +/// #[cfg(target_endian = "big")]
> > +/// match result {
> > +/// Some(x) => assert_eq!(*x, 0x1020304),
> > +/// None => unreachable!()
> > +/// }
> > +/// ```
> > +///
> > /// # Safety
> > ///
> > /// All bit-patterns must be valid for this type. This type must not have interior mutability.
> > -pub unsafe trait FromBytes {}
> > +pub unsafe trait FromBytes {
> > + /// Converts a slice of bytes to a reference to `Self` when possible.
> > + fn from_bytes(bytes: &[u8]) -> Option<&Self>;
> > +
> > + /// Converts a mutable slice of bytes to a reference to `Self` when possible.
> > + fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> > + where
> > + Self: AsBytes;
> > +}
> >
> > macro_rules! impl_frombytes {
> > ($($({$($generics:tt)*})? $t:ty, )*) => {
> > // SAFETY: Safety comments written in the macro invocation.
> > - $(unsafe impl$($($generics)*)? FromBytes for $t {})*
> > + $(unsafe impl$($($generics)*)? FromBytes for $t {
> > + fn from_bytes(bytes: &[u8]) -> Option<&$t> {
>
> Consider factoring this out into a helper function, e.g.
> ```
> fn from_bytes_sized<T: FromBytes + Sized>(bytes: &[u8]) -> Option<&T> {
> ```
> which you can then call in here. If you were not trying to handle
> `?Sized`, we could even put it in the trait default implementation.
>
> > + if bytes.len() == core::mem::size_of::<$t>() {
> > + let slice_ptr = bytes.as_ptr().cast::<$t>();
>
> There's no alignment check, and so the resulting constructed reference
> may be misaligned, which is UB. Same below.
>
> > + unsafe { Some(&*slice_ptr) }
> > + } else {
> > + None
> > + }
> > + }
> > +
> > + fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut $t>
Sorry, one last thing - could we consider `from_mut_bytes` instead of
`from_bytes_mut` to match the current API of `zerocopy`?
> > + where
> > + Self: AsBytes,
> > + {
> > + if bytes.len() == core::mem::size_of::<$t>() {
> > + let slice_ptr = bytes.as_mut_ptr().cast::<$t>();
> > + unsafe { Some(&mut *slice_ptr) }
> > + } else {
> > + None
> > + }
> > + }
> > + })*
> > };
> > }
> >
> > impl_frombytes! {
> > // SAFETY: All bit patterns are acceptable values of the types below.
> > + // Checking the pointer size makes this operation safe and it's necessary
> > + // to dereference to get the value and return it as a reference to `Self`.
> > u8, u16, u32, u64, usize,
> > i8, i16, i32, i64, isize,
> > -
> > - // SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
> > - // patterns are also acceptable for arrays of that type.
> > - {<T: FromBytes>} [T],
> > {<T: FromBytes, const N: usize>} [T; N],
> > }
> >
> > +// SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
> > +// patterns are also acceptable for arrays of that type.
> > +unsafe impl<T: FromBytes> FromBytes for [T] {
> > + fn from_bytes(bytes: &[u8]) -> Option<&Self> {
> > + let slice_ptr = bytes.as_ptr().cast::<T>();
> > + if bytes.len() % core::mem::size_of::<T>() == 0 {
> > + let slice_len = bytes.len() / core::mem::size_of::<T>();
> > + // SAFETY: Since the code checks the size and can be divided into blocks of size T
> > + // the slice is valid because the size is multiple of T.
> > + unsafe { Some(core::slice::from_raw_parts(slice_ptr, slice_len)) }
> > + } else {
> > + None
> > + }
> > + }
> > +
> > + fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> > + where
> > + Self: AsBytes,
> > + {
> > + let slice_ptr = bytes.as_mut_ptr().cast::<T>();
> > + if bytes.len() % core::mem::size_of::<T>() == 0 {
> > + let slice_len = bytes.len() / core::mem::size_of::<T>();
> > + // SAFETY: Since the code checks the size and can be divided into blocks of size T
> > + // the slice is valid because the size is multiple of T.
> > + unsafe { Some(core::slice::from_raw_parts_mut(slice_ptr, slice_len)) }
> > + } else {
> > + None
> > + }
> > + }
> > +}
> > +
> > /// Types that can be viewed as an immutable slice of initialized bytes.
> > ///
> > /// If a struct implements this trait, then it is okay to copy it byte-for-byte to userspace. This
> > --
> > 2.49.0
> >
> >
Powered by blists - more mailing lists