linux-kernel - Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <DC1ZVE8AM8GJ.3UZBQBW7HOFE3@kernel.org>
Date: Thu, 14 Aug 2025 10:06:50 +0200
From: "Benno Lossin" <lossin@...nel.org>
To: "Christian S. Lima" <christiansantoslima21@...il.com>, "Miguel Ojeda"
 <ojeda@...nel.org>, "Alex Gaynor" <alex.gaynor@...il.com>, "Boqun Feng"
 <boqun.feng@...il.com>, "Gary Guo" <gary@...yguo.net>,
 Björn Roy Baron <bjorn3_gh@...tonmail.com>, "Benno Lossin"
 <benno.lossin@...ton.me>, "Andreas Hindborg" <a.hindborg@...nel.org>,
 "Alice Ryhl" <aliceryhl@...gle.com>, "Trevor Gross" <tmgross@...ch.edu>,
 "Danilo Krummrich" <dakr@...nel.org>, <rust-for-linux@...r.kernel.org>,
 <linux-kernel@...r.kernel.org>, <~lkcamp/patches@...ts.sr.ht>,
 <richard120310@...il.com>
Subject: Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

On Mon Aug 11, 2025 at 11:38 PM CEST, Christian S. Lima wrote:
> @@ -9,27 +11,136 @@
>  ///
>  /// It's okay for the type to have padding, as initializing those bytes has no effect.
>  ///
> +/// # Examples
> +///
> +/// ```
> +/// use kernel::transmute::FromBytes;
> +///
> +/// let foo = [1, 2, 3, 4];
> +///
> +/// let result = u32::from_bytes(&foo)?;
> +///
> +/// #[cfg(target_endian = "little")]
> +/// assert_eq!(*result, 0x4030201);
> +///
> +/// #[cfg(target_endian = "big")]
> +/// assert_eq!(*result, 0x1020304);
> +/// ```
> +///
> +/// # Safety
> +///
> +/// All bit-patterns must be valid for this type. This type must not have interior mutability.
> +pub unsafe trait FromBytes {
> +    /// Converts a slice of bytes to a reference to `Self` when the reference
> +    /// is properly aligned and the size of slice is equal to that of `T`
> +    /// and is different from zero. In another case, it will return
> +    ///`None`.

The first line in any documentation should be a single, short sentence.
Also separate it from the contents by a newline, otherwise markdown will
render it as a single paragraph.

> +    fn from_bytes(bytes: &[u8]) -> Option<&Self>;
> +
> +    /// Converts a mutable slice of bytes to a reference to `Self`
> +    /// when the reference is properly aligned and the size of slice
> +    /// is equal to that of `T` and is different from zero. In another
> +    /// case, it will return `None`.
> +    fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> +    where
> +        Self: AsBytes;
> +}

> +
> +// SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
> +// patterns are also acceptable for arrays of that type.
> +unsafe impl<T: FromBytes> FromBytes for [T] {
> +    fn from_bytes(bytes: &[u8]) -> Option<&Self> {
> +        let size = ::core::mem::size_of::<T>();
> +        build_assert!(size == 0, "Can't create a slice with zero elements");

This message is wrong, it sounds as if the size of `bytes` was zero and
you can definitely create a slice with zero elements.

> +        let slice_ptr = bytes.as_ptr().cast::<T>();
> +        if bytes.len() % size == 0 && slice_ptr.is_aligned() {
> +            // SAFETY: Since the number of elements is different from
> +            // zero and the pointer is aligned, the slice is valid.

Please take a look at the documentation of `from_raw_parts`, there are
several bullet points of safety requirements. Please provide a
justification for each one and also place them in a bullet point list.

---
Cheers,
Benno

> +            unsafe { Some(::core::slice::from_raw_parts(slice_ptr, bytes.len() / size)) }
> +        } else {
> +            None
> +        }
> +    }
> +
> +    fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> +    where
> +        Self: AsBytes,
> +    {
> +        let size = ::core::mem::size_of::<T>();
> +        build_assert!(size == 0, "Can't create a slice with zero elements");
> +        let slice_ptr = bytes.as_mut_ptr().cast::<T>();
> +        if bytes.len() % size == 0 && slice_ptr.is_aligned() {
> +            // SAFETY: Since the number of elements is different from
> +            // zero and the pointer is aligned, the slice is valid.
> +            unsafe {
> +                Some(::core::slice::from_raw_parts_mut(
> +                    slice_ptr,
> +                    bytes.len() / size,
> +                ))
> +            }
> +        } else {
> +            None
> +        }
> +    }
>  }
>  
>  /// Types that can be viewed as an immutable slice of initialized bytes.