linux-kernel - Re: [PATCH v3 05/10] rust: uaccess: add UserSliceWriter::write_slice

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aPtW8cT5YoIGVIH9@google.com>
Date: Fri, 24 Oct 2025 10:37:37 +0000
From: Alice Ryhl <aliceryhl@...gle.com>
To: Danilo Krummrich <dakr@...nel.org>
Cc: gregkh@...uxfoundation.org, rafael@...nel.org, ojeda@...nel.org, 
	alex.gaynor@...il.com, boqun.feng@...il.com, gary@...yguo.net, 
	bjorn3_gh@...tonmail.com, lossin@...nel.org, a.hindborg@...nel.org, 
	tmgross@...ch.edu, mmaurer@...gle.com, rust-for-linux@...r.kernel.org, 
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3 05/10] rust: uaccess: add UserSliceWriter::write_slice_file()

On Thu, Oct 23, 2025 at 02:43:20PM +0200, Danilo Krummrich wrote:
> On Thu Oct 23, 2025 at 1:20 PM CEST, Alice Ryhl wrote:
> > I would love to have infallible conversions from usize to u64 (and u32
> > to usize), but we can't really modify the stdlib to add them.
> 
> We can (and probably should) implement a kernel specific infallible one.
> 
> I think we also want a helper for `slice::len() as isize`.
> 
> > But even if we had them, it wouldn't help here since the target type is
> > i64, not u64. And there are usize values that don't fit in i64 - it's
> > just that in this case the usize fits in isize.
> 
> Sure, it doesn't change the code required for this case. Yet, I think that if we
> agree on having a kernel specific infallible conversions for usize -> u64 and
> isize -> i64, it makes this + operation formally more consistent.
> 
> Here's the diff I'd apply:
> 
> diff --git a/rust/kernel/fs/file.rs b/rust/kernel/fs/file.rs
> index 681b8a9e5d52..63478dd7deb8 100644
> --- a/rust/kernel/fs/file.rs
> +++ b/rust/kernel/fs/file.rs
> @@ -125,6 +125,22 @@ pub fn saturating_sub_usize(self, rhs: usize) -> Offset {
>      }
>  }
> 
> +impl core::ops::Add<isize> for Offset {
> +    type Output = Offset;
> +
> +    #[inline]
> +    fn add(self, rhs: isize) -> Offset {
> +        Offset(self.0 + rhs as bindings::loff_t)
> +    }
> +}
> +
> +impl core::ops::AddAssign<isize> for Offset {
> +    #[inline]
> +    fn add_assign(&mut self, rhs: isize) {
> +        self.0 += rhs as bindings::loff_t;
> +    }
> +}
> +
>  impl From<bindings::loff_t> for Offset {
>      #[inline]
>      fn from(v: bindings::loff_t) -> Self {
> diff --git a/rust/kernel/uaccess.rs b/rust/kernel/uaccess.rs
> index 20ea31781efb..44ee334c4507 100644
> --- a/rust/kernel/uaccess.rs
> +++ b/rust/kernel/uaccess.rs
> @@ -514,7 +514,8 @@ pub fn write_slice_file(&mut self, data: &[u8], offset: &mut file::Offset) -> Re
> 
>          let written = self.write_slice_partial(data, offset_index)?;
> 
> -        *offset = offset.saturating_add_usize(written);
> +        // OVERFLOW: `offset + written <= data.len() <= isize::MAX <= Offset::MAX`
> +        *offset += written as isize;
> 
>          Ok(written)
>      }
> 

This LGTM.
Reviewed-by: Alice Ryhl <aliceryhl@...gle.com>