linux-kernel - Re: [PATCH v4] rust: check type of `$ptr` in `container

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANiq72mFiCrzawVUVOU2giJtBVsRdAO3sGtDsZptPuFvmid3EQ@mail.gmail.com>
Date: Thu, 29 May 2025 23:19:49 +0200
From: Miguel Ojeda <miguel.ojeda.sandonis@...il.com>
To: Tamir Duberstein <tamird@...il.com>
Cc: Miguel Ojeda <ojeda@...nel.org>, Alex Gaynor <alex.gaynor@...il.com>, 
	Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>, 
	Björn Roy Baron <bjorn3_gh@...tonmail.com>, 
	Andreas Hindborg <a.hindborg@...nel.org>, Alice Ryhl <aliceryhl@...gle.com>, 
	Trevor Gross <tmgross@...ch.edu>, Danilo Krummrich <dakr@...nel.org>, Benno Lossin <lossin@...nel.org>, 
	rust-for-linux@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4] rust: check type of `$ptr` in `container_of!`

On Thu, May 29, 2025 at 3:11 PM Tamir Duberstein <tamird@...il.com> wrote:
>
> Add a compile-time check that `*$ptr` is of the type of `$type->$($f)*`.
> Rename those placeholders for clarity.
>
> Given the incorrect usage:
>
> > diff --git a/rust/kernel/rbtree.rs b/rust/kernel/rbtree.rs
> > index 8d978c896747..6a7089149878 100644
> > --- a/rust/kernel/rbtree.rs
> > +++ b/rust/kernel/rbtree.rs
> > @@ -329,7 +329,7 @@ fn raw_entry(&mut self, key: &K) -> RawEntry<'_, K, V> {
> >          while !(*child_field_of_parent).is_null() {
> >              let curr = *child_field_of_parent;
> >              // SAFETY: All links fields we create are in a `Node<K, V>`.
> > -            let node = unsafe { container_of!(curr, Node<K, V>, links) };
> > +            let node = unsafe { container_of!(curr, Node<K, V>, key) };
> >
> >              // SAFETY: `node` is a non-null node so it is valid by the type invariants.
> >              match key.cmp(unsafe { &(*node).key }) {
>
> this patch produces the compilation error:
>
> > error[E0308]: mismatched types
> >    --> rust/kernel/lib.rs:220:45
> >     |
> > 220 |         $crate::assert_same_type(field_ptr, (&raw const (*container_ptr).$($fields)*).cast_mut());
> >     |         ------------------------ ---------  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ expected `*mut rb_node`, found `*mut K`
> >     |         |                        |
> >     |         |                        expected all arguments to be this `*mut bindings::rb_node` type because they need to match the type of this parameter
> >     |         arguments to this function are incorrect
> >     |
> >    ::: rust/kernel/rbtree.rs:270:6
> >     |
> > 270 | impl<K, V> RBTree<K, V>
> >     |      - found this type parameter
> > ...
> > 332 |             let node = unsafe { container_of!(curr, Node<K, V>, key) };
> >     |                                 ------------------------------------ in this macro invocation
> >     |
> >     = note: expected raw pointer `*mut bindings::rb_node`
> >                found raw pointer `*mut K`
> > note: function defined here
> >    --> rust/kernel/lib.rs:227:8
> >     |
> > 227 | pub fn assert_same_type<T>(_: T, _: T) {}
> >     |        ^^^^^^^^^^^^^^^^ -  ----  ---- this parameter needs to match the `*mut bindings::rb_node` type of parameter #1
> >     |                         |  |
> >     |                         |  parameter #2 needs to match the `*mut bindings::rb_node` type of this parameter
> >     |                         parameter #1 and parameter #2 both reference this parameter `T`
> >     = note: this error originates in the macro `container_of` (in Nightly builds, run with -Z macro-backtrace for more info)
>
> Suggested-by: Alice Ryhl <aliceryhl@...gle.com>
> Link: https://lore.kernel.org/all/CAH5fLgh6gmqGBhPMi2SKn7mCmMWfOSiS0WP5wBuGPYh9ZTAiww@mail.gmail.com/
> Signed-off-by: Tamir Duberstein <tamird@...il.com>

Applied to `rust-next` -- thanks everyone!

    [ We decided to go with a variation of v1 [1] that became v4, since it
      seems like the obvious approach, the error messages seem good enough
      and the debug performance should be fine, given the kernel is always
      built with -O2.

      In the future, we may want to make the helper non-hidden, with
      proper documentation, for others to use.

      [1] https://lore.kernel.org/rust-for-linux/CANiq72kQWNfSV0KK6qs6oJt+aGdgY=hXg=wJcmK3zYcokY1LNw@mail.gmail.com/

        - Miguel ]

    [ Added intra-doc link. - Miguel ]

Cheers,
Miguel