linux-kernel - Re: [RFC PATCH v3 3/5] rust: io_uring: introduce rust abstraction for io-uring cmd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <DCDVRPJKZBC3.31KGTGS90WUUA@kernel.org>
Date: Thu, 28 Aug 2025 09:25:56 +0200
From: "Benno Lossin" <lossin@...nel.org>
To: "Ming Lei" <ming.lei@...hat.com>, "Sidong Yang" <sidong.yang@...iosa.ai>
Cc: "Jens Axboe" <axboe@...nel.dk>, "Daniel Almeida"
 <daniel.almeida@...labora.com>, "Caleb Sander Mateos"
 <csander@...estorage.com>, "Miguel Ojeda" <ojeda@...nel.org>, "Arnd
 Bergmann" <arnd@...db.de>, "Greg Kroah-Hartman"
 <gregkh@...uxfoundation.org>, <rust-for-linux@...r.kernel.org>,
 <linux-kernel@...r.kernel.org>, <io-uring@...r.kernel.org>
Subject: Re: [RFC PATCH v3 3/5] rust: io_uring: introduce rust abstraction
 for io-uring cmd

On Thu Aug 28, 2025 at 2:36 AM CEST, Ming Lei wrote:
> On Fri, Aug 22, 2025 at 12:55:53PM +0000, Sidong Yang wrote:
>> +    /// Reads protocol data unit as `T` that impl `FromBytes` from uring cmd
>> +    ///
>> +    /// Fails with [`EFAULT`] if size of `T` is bigger than pdu size.
>> +    #[inline]
>> +    pub fn read_pdu<T: FromBytes>(&self) -> Result<T> {
>> +        // SAFETY: `self.inner` is guaranteed by the type invariant to point
>> +        // to a live `io_uring_cmd`, so dereferencing is safe.
>> +        let inner = unsafe { &mut *self.inner.get() };
>> +
>> +        let len = size_of::<T>();
>> +        if len > inner.pdu.len() {
>> +            return Err(EFAULT);
>> +        }
>> +
>> +        let mut out: MaybeUninit<T> = MaybeUninit::uninit();
>> +        let ptr = &raw mut inner.pdu as *const c_void;
>> +
>> +        // SAFETY:
>> +        // * The `ptr` is valid pointer from `self.inner` that is guaranteed by type invariant.
>> +        // * The `out` is valid pointer that points `T` which impls `FromBytes` and checked
>> +        //   size of `T` is smaller than pdu size.
>> +        unsafe {
>> +            core::ptr::copy_nonoverlapping(ptr, out.as_mut_ptr().cast::<c_void>(), len);
>> +        }
>> +
>> +        // SAFETY: The read above has initialized all bytes in `out`, and since `T` implements
>> +        // `FromBytes`, any bit-pattern is a valid value for this type.
>> +        Ok(unsafe { out.assume_init() })
>> +    }
>> +
>> +    /// Writes the provided `value` to `pdu` in uring_cmd `self`
>> +    ///
>> +    /// Fails with [`EFAULT`] if size of `T` is bigger than pdu size.
>> +    #[inline]
>> +    pub fn write_pdu<T: AsBytes>(&mut self, value: &T) -> Result<()> {
>> +        // SAFETY: `self.inner` is guaranteed by the type invariant to point
>> +        // to a live `io_uring_cmd`, so dereferencing is safe.
>> +        let inner = unsafe { &mut *self.inner.get() };
>> +
>> +        let len = size_of::<T>();
>> +        if len > inner.pdu.len() {
>> +            return Err(EFAULT);
>> +        }
>> +
>> +        let src = (value as *const T).cast::<c_void>();
>> +        let dst = &raw mut inner.pdu as *mut c_void;
>> +
>> +        // SAFETY:
>> +        // * The `src` is points valid memory that is guaranteed by `T` impls `AsBytes`
>> +        // * The `dst` is valid. It's from `self.inner` that is guaranteed by type invariant.
>> +        // * It's safe to copy because size of `T` is no more than len of pdu.
>> +        unsafe {
>> +            core::ptr::copy_nonoverlapping(src, dst, len);
>> +        }
>> +
>> +        Ok(())
>> +    }
>
> pdu is part of IoUringCmd, which is live in the whole uring_cmd lifetime. But
> both read_pdu()/write_pdu() needs copy to read or write any byte in the pdu, which
> is slow and hard to use, it could be more efficient to add two methods to return
> Result<&T> and Result<mut &T> for user to manipulate uring_cmd's pdu.

That can also be useful, but you do need to ensure that the pdu is
aligned to at least the required alignment of `T` for this to be sound.
I also don't follow your argument that reading & writing the pdu is
slow.

---
Cheers,
Benno