linux-kernel - Re: [PATCH] rust: time: Seal the ClockSource trait

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aFQS5egeo4xfFbNF@Mac.home>
Date: Thu, 19 Jun 2025 06:38:45 -0700
From: Boqun Feng <boqun.feng@...il.com>
To: Andreas Hindborg <a.hindborg@...nel.org>
Cc: FUJITA Tomonori <fujita.tomonori@...il.com>, alex.gaynor@...il.com,
	ojeda@...nel.org, aliceryhl@...gle.com, anna-maria@...utronix.de,
	bjorn3_gh@...tonmail.com, dakr@...nel.org, frederic@...nel.org,
	gary@...yguo.net, jstultz@...gle.com, linux-kernel@...r.kernel.org,
	lossin@...nel.org, lyude@...hat.com, rust-for-linux@...r.kernel.org,
	sboyd@...nel.org, tglx@...utronix.de, tmgross@...ch.edu
Subject: Re: [PATCH] rust: time: Seal the ClockSource trait

On Thu, Jun 19, 2025 at 02:57:12PM +0200, Andreas Hindborg wrote:
[...]
> >>
> >>
> >>   pub trait ClockSource {
> >>       /// The kernel clock ID associated with this clock source.
> >>       ///
> >>       /// This constant corresponds to the C side `clockid_t` value.
> >>       const ID: bindings::clockid_t;
> >>
> >> The constant used to identify the clock source when calling into C APIs.
> >
> > Ah, I see. Sorry to ask another question, but can we require
> > correlation between ID and the value fetched by `ktime_get`?
> 
> Yes, I think we should. As in, `ClockSource::ktime_get` must return the
> time associated with the clock specified by `ClockSource::ID`.
> 
> >The value
> > fetched by ktime_get is opaque, isn't it?
> 
> It is, but the implementation must still fetch the correct counter, right?
> Not sure if it could lead to UB if it did not though 🤷
> 

The reason that we need ktime_get() to return value in [0, KTIME_MAX) is
because Instant's type invariants (and Instant's type invariants is for
subtraction not overflowing), so I would say this is not a safety
requirement for impl ClockSource.

Regards,
Boqun

> 
> Best regards,
> Andreas Hindborg
> 
> 
>