linux-kernel - Re: rust: wrong SAFETY comments in group

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aTMUqp5pXzAscrdZ@redhat.com>
Date: Fri, 5 Dec 2025 18:21:46 +0100
From: Oleg Nesterov <oleg@...hat.com>
To: Alice Ryhl <aliceryhl@...gle.com>
Cc: Christian Brauner <christian@...uner.io>,
	Miguel Ojeda <ojeda@...nel.org>,
	Alex Gaynor <alex.gaynor@...il.com>,
	Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>,
	Björn Roy Baron <bjorn3_gh@...tonmail.com>,
	Benno Lossin <lossin@...nel.org>,
	Andreas Hindborg <a.hindborg@...nel.org>,
	Trevor Gross <tmgross@...ch.edu>,
	Danilo Krummrich <dakr@...nel.org>,
	Panagiotis Foliadis <pfoliadis@...teo.net>,
	Shankari Anand <shankari.ak0208@...il.com>,
	FUJITA Tomonori <fujita.tomonori@...il.com>,
	Alexey Gladkov <legion@...nel.org>, rust-for-linux@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: rust: wrong SAFETY comments in group_leader() and pid() +
 questions

On 12/05, Alice Ryhl wrote:
>
> pub fn group_leader(&self) -> &Task {
>     // SAFETY: The lifetime of the returned task reference is tied to
>     // the lifetime of `self`, and given that a task has a reference to
>     // its group leader, we know it must be valid for the lifetime of
>     // the returned task reference.
>     unsafe { &*bindings::task_group_leader(self.as_ptr()).cast::<Task>() }
> }

Thanks again Alice, but the comment still looks misleading to me...
OK, quite possibly this is because I don't understand what does the
"lifetime of the returned task reference" actually mean in the rust code.
Does it mean "lifetime of task_struct" of "lifetime of the process/thread" ?

Let me provide the artificial example. Suppose we have something like

	struct task_struct *TASK = NULL;

	void stupid_example(void)
	{
		TASK = get_task_struct(current);

		do_exit(0);
	}

and a non-leader task calls stupid_example().

After that the global TASK pointer is still valid, it is safe to
dereference it, task_struct itself can't go away.

But! Right after that TASK->group_leader can point to nowhere (to the freed memory)
if another thread does do_group_exit() or sys_execve().

So. Perhaps the the comment should say something like

	SAFETY: The lifetime of the returned task reference is tied to
	the lifetime of the THREAD represented by `self`

?

Oleg.