linux-kernel - Re: [PATCH 1/2] rust: pin-init: improve safety documentation for `impl<T> [Pin]Init<T> for T`

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aDiviL-n1FtNCtRT@winterfell.localdomain>
Date: Thu, 29 May 2025 12:03:36 -0700
From: Boqun Feng <boqun.feng@...il.com>
To: Benno Lossin <lossin@...nel.org>
Cc: Miguel Ojeda <ojeda@...nel.org>, Alex Gaynor <alex.gaynor@...il.com>,
	Gary Guo <gary@...yguo.net>,
	Björn Roy Baron <bjorn3_gh@...tonmail.com>,
	Andreas Hindborg <a.hindborg@...nel.org>,
	Alice Ryhl <aliceryhl@...gle.com>, Trevor Gross <tmgross@...ch.edu>,
	Danilo Krummrich <dakr@...nel.org>, Fiona Behrens <me@...enk.dev>,
	Christian Schrefl <chrisi.schrefl@...il.com>,
	rust-for-linux@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] rust: pin-init: improve safety documentation for
 `impl<T> [Pin]Init<T> for T`

On Thu, May 29, 2025 at 10:10:23AM +0200, Benno Lossin wrote:
> The inner SAFETY comments were missing since commit 5cfe7bef6751 ("rust:
> enable `clippy::undocumented_unsafe_blocks` lint").
> 
> Also rework the implementation of `__pinned_init` to better justify the
> SAFETY comment.
> 
> Link: https://github.com/Rust-for-Linux/pin-init/pull/62/commits/df925b2e27d499b7144df7e62b01acb00d4b94b8
> Signed-off-by: Benno Lossin <lossin@...nel.org>

Reviewed-by: Boqun Feng <boqun.feng@...il.com>

Regards,
Boqun

> ---
>  rust/pin-init/src/lib.rs | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/rust/pin-init/src/lib.rs b/rust/pin-init/src/lib.rs
> index 9ab34036e6bc..d1c3ca5cfff4 100644
> --- a/rust/pin-init/src/lib.rs
> +++ b/rust/pin-init/src/lib.rs
> @@ -1390,20 +1390,22 @@ pub fn pin_init_array_from_fn<I, const N: usize, T, E>(
>      unsafe { pin_init_from_closure(init) }
>  }
>  
> -// SAFETY: Every type can be initialized by-value.
> +// SAFETY: the `__init` function always returns `Ok(())` and initializes every field of `slot`.
>  unsafe impl<T, E> Init<T, E> for T {
>      unsafe fn __init(self, slot: *mut T) -> Result<(), E> {
> -        // SAFETY: TODO.
> +        // SAFETY: `slot` is valid for writes by the safety requirements of this function.
>          unsafe { slot.write(self) };
>          Ok(())
>      }
>  }
>  
> -// SAFETY: Every type can be initialized by-value. `__pinned_init` calls `__init`.
> +// SAFETY: the `__pinned_init` function always returns `Ok(())` and initializes every field of
> +// `slot`. Additionally, all pinning invariants of `T` are upheld.
>  unsafe impl<T, E> PinInit<T, E> for T {
>      unsafe fn __pinned_init(self, slot: *mut T) -> Result<(), E> {
> -        // SAFETY: TODO.
> -        unsafe { self.__init(slot) }
> +        // SAFETY: `slot` is valid for writes by the safety requirements of this function.
> +        unsafe { slot.write(self) };
> +        Ok(())
>      }
>  }
>  
> 
> base-commit: 1ce98bb2bb30713ec4374ef11ead0d7d3e856766
> -- 
> 2.49.0
>