linux-kernel - Re: [RFC PATCH v2 2/4] rust: io_uring: introduce rust abstraction for io-uring cmd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <DBRVVTJ5LDV2.2NHTJ4S490N8@kernel.org>
Date: Sat, 02 Aug 2025 12:52:39 +0200
From: "Benno Lossin" <lossin@...nel.org>
To: "Daniel Almeida" <daniel.almeida@...labora.com>, "Sidong Yang"
 <sidong.yang@...iosa.ai>
Cc: "Caleb Sander Mateos" <csander@...estorage.com>, "Miguel Ojeda"
 <ojeda@...nel.org>, "Arnd Bergmann" <arnd@...db.de>, "Jens Axboe"
 <axboe@...nel.dk>, "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>,
 <rust-for-linux@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
 <io-uring@...r.kernel.org>
Subject: Re: [RFC PATCH v2 2/4] rust: io_uring: introduce rust abstraction
 for io-uring cmd

On Fri Aug 1, 2025 at 3:48 PM CEST, Daniel Almeida wrote:
>> On 27 Jul 2025, at 12:03, Sidong Yang <sidong.yang@...iosa.ai> wrote:
>> +    #[inline]
>> +    pub fn pdu(&mut self) -> &mut MaybeUninit<[u8; 32]> {
>
> Why MaybeUninit? Also, this is a question for others, but I don’t think
> that `u8`s can ever be uninitialized as all byte values are valid for `u8`.

`u8` can be uninitialized. Uninitialized doesn't just mean "can take any
bit pattern", but also "is known to the compiler as being
uninitialized". The docs of `MaybeUninit` explain it like this:

    Moreover, uninitialized memory is special in that it does not have a
    fixed value (“fixed” meaning “it won’t change without being written
    to”). Reading the same uninitialized byte multiple times can give
    different results.

But the return type probably should be `&mut [MaybeUninit<u8>; 32]`
instead.

>> +    #[inline]
>> +    pub unsafe fn from_raw<'a>(ptr: *mut bindings::io_uring_cmd) -> Pin<&'a mut IoUringCmd> {
>> +        // SAFETY: The caller guarantees that the pointer is not dangling and stays valid for the
>> +        // duration of 'a. The cast is okay because `IoUringCmd` is `repr(transparent)` and has the
>> +        // same memory layout as `bindings::io_uring_cmd`. The returned `Pin` ensures that the object
>> +        // cannot be moved, which is required because the kernel may hold pointers to this memory
>> +        // location and moving it would invalidate those pointers.
>
> Please break this into multiple paragraphs.

We usually use bullet point lists for this. 

---
Cheers,
Benno