linux-kernel - Re: [PATCH v2] uaccess: rust: use newtype for user pointers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <DA82XR7C0NCM.DPN2F8RHAB3Y@kernel.org>
Date: Wed, 28 May 2025 22:35:01 +0200
From: "Benno Lossin" <lossin@...nel.org>
To: "Al Viro" <viro@...iv.linux.org.uk>, "Alice Ryhl" <aliceryhl@...gle.com>
Cc: "Miguel Ojeda" <ojeda@...nel.org>, "Greg Kroah-Hartman"
 <gregkh@...uxfoundation.org>, "Arnd Bergmann" <arnd@...db.de>, "Andrew
 Morton" <akpm@...ux-foundation.org>, "Boqun Feng" <boqun.feng@...il.com>,
 "Gary Guo" <gary@...yguo.net>, Björn Roy Baron
 <bjorn3_gh@...tonmail.com>, "Benno Lossin" <benno.lossin@...ton.me>,
 "Andreas Hindborg" <a.hindborg@...nel.org>, "Trevor Gross"
 <tmgross@...ch.edu>, "Danilo Krummrich" <dakr@...nel.org>,
 <rust-for-linux@...r.kernel.org>, <linux-kernel@...r.kernel.org>, "Al Viro"
 <viro@....linux.org.uk>
Subject: Re: [PATCH v2] uaccess: rust: use newtype for user pointers

On Wed May 28, 2025 at 7:45 PM CEST, Al Viro wrote:
> On Wed, May 28, 2025 at 10:47:12AM +0000, Alice Ryhl wrote:
>
>> We don't currently have any way to perform that kind of pointer-math on
>> user pointers, nor do we have any users of it. I imagine that this type
>> checking is only useful if you can actually perform pointer math in the
>> first place?
>
> What you want is something like
> 	x->field::UserPtr(beta) iff
> 		x::UserPtr(alpha) and
> 		_.field::beta where _::alpha

Not 100% sure I understand your code correctly, do you mean that:
`x->field` is of type `UserPtr(beta)` given that `x` is of type
`UserPtr(alpha)` and `field` is a field of `alpha` of type `beta`?

If that is correct, then I have a proposal called field projection [1]
for the rust language itself to support this kind of operation for any
custom type.

I also have an macro-based implementation [2] and I could cook up some
examples with `UserPtr` [^3].

[1]: https://github.com/rust-lang/rfcs/pull/3735
[2]: https://github.com/Rust-for-Linux/field-projection/tree/new
[^3]: Here is a quick sketch of how the above would look like in Rust
      using [2]:

      #[derive(HasFields)]
      struct Alpha {
          field: Beta,
      }

      impl Alpha {
          fn write_beta<'a>(mut self: UserPtr<'a, Self>, value: Beta) {
              start_proj!(mut self);
              let mut field: UserPtr<'a, Beta> = p!(@mut self->field);
              field.write(value);
          }
      }

      A couple notes for anyone not too familiar with Rust:

      * `'a` is called a lifetime, it says for how long a value is valid
      * the `< ... >` are generic types
      * the `ident: Type` is a type annotation used in parameters (not
        optional) and in local variable bindings (optional)
      * the `self` parameter is special, it allows one to use the
        `val.fun` syntax (it's similar to `this` in java and `self` in
        python, but without the object orientation stuff associated with
        it)

---
Cheers,
Benno

> Generated code would be "add offset and cast to pointer to type of...",
> but doing that manually would really invite headache.