linux-kernel - Re: [PATCH v1] rust: time: make ClockSource unsafe trait

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAH5fLgjdpso4waCrP6iVaMEOpYLUmqCz8PxqXuSbQBMaxxCHBw@mail.gmail.com>
Date: Wed, 2 Jul 2025 11:50:35 +0200
From: Alice Ryhl <aliceryhl@...gle.com>
To: Andreas Hindborg <a.hindborg@...nel.org>
Cc: FUJITA Tomonori <fujita.tomonori@...il.com>, alex.gaynor@...il.com, ojeda@...nel.org, 
	boqun.feng@...il.com, anna-maria@...utronix.de, bjorn3_gh@...tonmail.com, 
	dakr@...nel.org, frederic@...nel.org, gary@...yguo.net, jstultz@...gle.com, 
	linux-kernel@...r.kernel.org, lossin@...nel.org, lyude@...hat.com, 
	rust-for-linux@...r.kernel.org, sboyd@...nel.org, tglx@...utronix.de, 
	tmgross@...ch.edu
Subject: Re: [PATCH v1] rust: time: make ClockSource unsafe trait

On Wed, Jul 2, 2025 at 11:17 AM Andreas Hindborg <a.hindborg@...nel.org> wrote:
>
> "FUJITA Tomonori" <fujita.tomonori@...il.com> writes:
>
> > On Mon, 30 Jun 2025 15:33:31 +0200
> > Alice Ryhl <aliceryhl@...gle.com> wrote:
> >
> >> On Mon, Jun 30, 2025 at 3:10 PM FUJITA Tomonori
> >> <fujita.tomonori@...il.com> wrote:
> >>>
> >>> Mark the ClockSource trait as unsafe and document its safety
> >>> requirements. Specifically, implementers must guarantee that their
> >>> `ktime_get()` implementation returns a value in the inclusive range
> >>> [0, KTIME_MAX].
> >>>
> >>> Update all existing implementations to use `unsafe impl` with
> >>> corresponding safety comments.
> >>>
> >>> Note that there could be potential users of a customized clock source [1]
> >>> so we don't seal the trait.
> >>>
> >>> Link: https://lore.kernel.org/rust-for-linux/Z9xb1r1x5tOzAIZT@boqun-archlinux/ [1]
> >>> Suggested-by: Boqun Feng <boqun.feng@...il.com>
> >>> Signed-off-by: FUJITA Tomonori <fujita.tomonori@...il.com>
> >>
> >> LGTM:
> >> Reviewed-by: Alice Ryhl <aliceryhl@...gle.com>
> >
> > Thanks!
> >
> >> Though you're missing `` around [0; KTIME_MAX] in some places, which
> >> may be worth adding.
> >
> > Andreas, would you like me to send v2 with the above changes?
>
> Perhaps we should use rust ranges instead [1]? Like this, no brackets: `0..=KTIME_MAX`.

Well, maybe. But I think it's also worth considering just using
english to describe it:

Implementers must ensure that `ktime_get()` returns a positive value
less than or equal to `KTIME_MAX`.

Alice