Re: [PATCH v4 03/22] rust: create basic untrusted data API

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] rust: validate: Untrusted Deref implementations violate cast_slice safety contract
- [Low] rust: validate: typo in module documentation
- [Low] rust: validate: imports do not follow vertical style
--

commit faffe058082273ce8374694a0c1cc53da4578ae7
Author: Benno Lossin <lossin@kernel.org>

rust: create basic untrusted data API

This commit introduces the Untrusted<T> wrapper type to explicitly mark data
originating from untrusted sources, such as userspace. It allows validating
the data before making logical decisions based on its value.

Link: Message-ID: <20250814124424.516191-3-lossin@kernel.org>

> diff --git a/rust/kernel/validate.rs b/rust/kernel/validate.rs
> new file mode 100644
> index 0000000000000..ca2e5abda3e25
> --- /dev/null
> +++ b/rust/kernel/validate.rs
> @@ -0,0 +1,147 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +//! Untrusted data API.

[ ... ]

> +use core::ops::{Deref, DerefMut};

[Severity: Low]
Does this import follow the vertical import style? The subsystem guidelines
request following the vertical style for imports.

> +
> +use crate::{

[ ... ]

> +/// The reason for this is that `&mut Untrusted<[u8]>` can beconverted into `&mut [Untrusted<u8>]`

[Severity: Low]
There appears to be a typo here ("beconverted" instead of "be converted").

> +/// very easily, but the converse is not possible.

[ ... ]

> +impl<T> Deref for Untrusted<[T]> {
> +    type Target = [Untrusted<T>];
> +
> +    #[inline]
> +    fn deref(&self) -> &Self::Target {
> +        // SAFETY: `Untrusted<T>` transparently wraps `T`.
> +        unsafe { cast_slice(&self.0) }

[Severity: High]
Does this violate the safety contract of cast_slice? The documented safety
precondition of kernel::transmute::cast_slice requires that neither T nor U
have interior mutability. However, Untrusted::new and this Deref implementation
don't place any trait bounds on T preventing interior mutability, which could
allow safely constructing and dereferencing something like
Untrusted<Vec<Cell<u8>>>.

> +    }
> +}
> +
> +impl<T> DerefMut for Untrusted<[T]> {
> +    #[inline]
> +    fn deref_mut(&mut self) -> &mut Self::Target {
> +        // SAFETY: `Untrusted<T>` transparently wraps `T`.
> +        unsafe { cast_slice_mut(&mut self.0) }

[Severity: High]
Similarly, does this violate the safety contract of cast_slice_mut by lacking
a check against interior mutability?

> +    }
> +}
> +
> +impl<T, A: Allocator> Deref for Untrusted<Vec<T, A>> {
> +    type Target = [Untrusted<T>];
> +
> +    #[inline]
> +    fn deref(&self) -> &Self::Target {
> +        // SAFETY: `Untrusted<T>` transparently wraps `T`.
> +        unsafe { cast_slice(self.0.as_slice()) }

[Severity: High]
Does this violate the interior mutability ban for cast_slice?

> +    }
> +}
> +
> +impl<T, A: Allocator> DerefMut for Untrusted<Vec<T, A>> {
> +    #[inline]
> +    fn deref_mut(&mut self) -> &mut Self::Target {
> +        // SAFETY: `Untrusted<T>` transparently wraps `T`.
> +        unsafe { cast_slice_mut(self.0.as_mut_slice()) }

[Severity: High]
Does this violate the interior mutability ban for cast_slice_mut?

> +    }
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928011123.450800-1-alistair.francis@wdc.com?part=3