linux-kernel - [PATCH 2/2] rust: derive `Zeroable` for all structs & unions generated by bindgen where possible

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250520192307.259142-2-lossin@kernel.org>
Date: Tue, 20 May 2025 21:23:06 +0200
From: Benno Lossin <lossin@...nel.org>
To: Miguel Ojeda <ojeda@...nel.org>,
	Alex Gaynor <alex.gaynor@...il.com>,
	Boqun Feng <boqun.feng@...il.com>,
	Gary Guo <gary@...yguo.net>,
	Björn Roy Baron <bjorn3_gh@...tonmail.com>,
	Benno Lossin <benno.lossin@...ton.me>,
	Andreas Hindborg <a.hindborg@...nel.org>,
	Alice Ryhl <aliceryhl@...gle.com>,
	Trevor Gross <tmgross@...ch.edu>,
	Danilo Krummrich <dakr@...nel.org>,
	Fiona Behrens <me@...enk.dev>
Cc: Lyude Paul <lyude@...hat.com>,
	Benno Lossin <lossin@...nel.org>,
	rust-for-linux@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH 2/2] rust: derive `Zeroable` for all structs & unions generated by bindgen where possible

Using the `--with-derive-custom-{struct,union}` option of bindgen, add
`#[derive(MaybeZeroable)]` to every struct & union. This makes those
types implement `Zeroable` if all their fields implement it.

Sadly bindgen doesn't add custom derives to the `__BindgenBitfieldUnit`
struct. So manually implement `Zeroable` for that.

Signed-off-by: Benno Lossin <lossin@...nel.org>
---

This came from a discussion at [1]. The relevant parts for pin-init
already got merged into rust-next for v6.16, so we only need to enable
them for bindgen.

I'm not sure on the impact of build times and rust-analyzer. We're
adding a derive macro to every struct and union emitted by bindgen.
Building using my test-config took 28.6s before and 29.1s after this
change, but those are only two runs.

Maybe we have to reevaluate this when more C code is scanned by bindgen.

[1]: https://rust-for-linux.zulipchat.com/#narrow/channel/291565-Help/topic/Zeroable.20trait.20for.20C.20structs/with/509711564

---
 rust/bindgen_parameters | 4 ++++
 rust/bindings/lib.rs    | 9 +++++++++
 2 files changed, 13 insertions(+)

diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index 0f96af8b9a7f..fa4c61ba028f 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -34,3 +34,7 @@
 # We use const helpers to aid bindgen, to avoid conflicts when constants are
 # recognized, block generation of the non-helper constants.
 --blocklist-item ARCH_SLAB_MINALIGN
+
+# Structs should implement Zeroable when all of their fields do.
+--with-derive-custom-struct .*=pin_init::MaybeZeroable
+--with-derive-custom-union .*=pin_init::MaybeZeroable
diff --git a/rust/bindings/lib.rs b/rust/bindings/lib.rs
index a08eb5518cac..38615c5b090d 100644
--- a/rust/bindings/lib.rs
+++ b/rust/bindings/lib.rs
@@ -33,6 +33,15 @@ mod bindings_raw {
     type __kernel_ssize_t = isize;
     type __kernel_ptrdiff_t = isize;
 
+    // `bindgen` doesn't automatically do this, see
+    // <https://github.com/rust-lang/rust-bindgen/issues/3196>
+    //
+    // SAFETY: `__BindgenBitfieldUnit<Storage>` is a newtype around `Storage`.
+    unsafe impl<Storage> pin_init::Zeroable for __BindgenBitfieldUnit<Storage> where
+        Storage: pin_init::Zeroable
+    {
+    }
+
     // Use glob import here to expose all helpers.
     // Symbols defined within the module will take precedence to the glob import.
     pub use super::bindings_helper::*;
-- 
2.49.0