linux-kernel - Re: [PATCH 2/2] rust: derive `Zeroable` for all structs & unions generated by bindgen where possible

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAH5fLghdQEsBCfLVy2nUBvY6=5QTeaFyqtHHSjPDaX-1BKP=6g@mail.gmail.com>
Date: Tue, 20 May 2025 14:38:10 -0700
From: Alice Ryhl <aliceryhl@...gle.com>
To: Benno Lossin <lossin@...nel.org>
Cc: Miguel Ojeda <ojeda@...nel.org>, Alex Gaynor <alex.gaynor@...il.com>, 
	Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>, 
	Björn Roy Baron <bjorn3_gh@...tonmail.com>, 
	Benno Lossin <benno.lossin@...ton.me>, Andreas Hindborg <a.hindborg@...nel.org>, 
	Trevor Gross <tmgross@...ch.edu>, Danilo Krummrich <dakr@...nel.org>, Fiona Behrens <me@...enk.dev>, 
	Lyude Paul <lyude@...hat.com>, rust-for-linux@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] rust: derive `Zeroable` for all structs & unions
 generated by bindgen where possible

On Tue, May 20, 2025 at 12:23 PM Benno Lossin <lossin@...nel.org> wrote:
>
> Using the `--with-derive-custom-{struct,union}` option of bindgen, add
> `#[derive(MaybeZeroable)]` to every struct & union. This makes those
> types implement `Zeroable` if all their fields implement it.

I think this is a great idea.

> Sadly bindgen doesn't add custom derives to the `__BindgenBitfieldUnit`
> struct. So manually implement `Zeroable` for that.
>
> Signed-off-by: Benno Lossin <lossin@...nel.org>
> ---
>
> This came from a discussion at [1]. The relevant parts for pin-init
> already got merged into rust-next for v6.16, so we only need to enable
> them for bindgen.
>
> I'm not sure on the impact of build times and rust-analyzer. We're
> adding a derive macro to every struct and union emitted by bindgen.
> Building using my test-config took 28.6s before and 29.1s after this
> change, but those are only two runs.
>
> Maybe we have to reevaluate this when more C code is scanned by bindgen.
>
> [1]: https://rust-for-linux.zulipchat.com/#narrow/channel/291565-Help/topic/Zeroable.20trait.20for.20C.20structs/with/509711564
>
> ---
>  rust/bindgen_parameters | 4 ++++
>  rust/bindings/lib.rs    | 9 +++++++++
>  2 files changed, 13 insertions(+)
>
> diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
> index 0f96af8b9a7f..fa4c61ba028f 100644
> --- a/rust/bindgen_parameters
> +++ b/rust/bindgen_parameters
> @@ -34,3 +34,7 @@
>  # We use const helpers to aid bindgen, to avoid conflicts when constants are
>  # recognized, block generation of the non-helper constants.
>  --blocklist-item ARCH_SLAB_MINALIGN
> +
> +# Structs should implement Zeroable when all of their fields do.
> +--with-derive-custom-struct .*=pin_init::MaybeZeroable
> +--with-derive-custom-union .*=pin_init::MaybeZeroable

Maybe add an import in bindings/lib.rs and use it directly? Seems a
bit nicer to read without the prefix.

> diff --git a/rust/bindings/lib.rs b/rust/bindings/lib.rs
> index a08eb5518cac..38615c5b090d 100644
> --- a/rust/bindings/lib.rs
> +++ b/rust/bindings/lib.rs
> @@ -33,6 +33,15 @@ mod bindings_raw {
>      type __kernel_ssize_t = isize;
>      type __kernel_ptrdiff_t = isize;
>
> +    // `bindgen` doesn't automatically do this, see
> +    // <https://github.com/rust-lang/rust-bindgen/issues/3196>
> +    //
> +    // SAFETY: `__BindgenBitfieldUnit<Storage>` is a newtype around `Storage`.
> +    unsafe impl<Storage> pin_init::Zeroable for __BindgenBitfieldUnit<Storage> where
> +        Storage: pin_init::Zeroable
> +    {
> +    }
> +
>      // Use glob import here to expose all helpers.
>      // Symbols defined within the module will take precedence to the glob import.
>      pub use super::bindings_helper::*;
> --
> 2.49.0
>