Re: [PATCH v9] rust: transmute: Add methods for FromBytes trait

["Benno Lossin" <lossin@kernel.org>]

On Mon Aug 11, 2025 at 11:38 PM CEST, Christian S. Lima wrote:
> @@ -9,27 +11,136 @@
>  ///
>  /// It's okay for the type to have padding, as initializing those bytes has no effect.
>  ///
> +/// # Examples
> +///
> +/// ```
> +/// use kernel::transmute::FromBytes;
> +///
> +/// let foo = [1, 2, 3, 4];
> +///
> +/// let result = u32::from_bytes(&foo)?;
> +///
> +/// #[cfg(target_endian = "little")]
> +/// assert_eq!(*result, 0x4030201);
> +///
> +/// #[cfg(target_endian = "big")]
> +/// assert_eq!(*result, 0x1020304);
> +/// ```
> +///
> +/// # Safety
> +///
> +/// All bit-patterns must be valid for this type. This type must not have interior mutability.
> +pub unsafe trait FromBytes {
> +    /// Converts a slice of bytes to a reference to `Self` when the reference
> +    /// is properly aligned and the size of slice is equal to that of `T`
> +    /// and is different from zero. In another case, it will return
> +    ///`None`.

The first line in any documentation should be a single, short sentence.
Also separate it from the contents by a newline, otherwise markdown will
render it as a single paragraph.

> +    fn from_bytes(bytes: &[u8]) -> Option<&Self>;
> +
> +    /// Converts a mutable slice of bytes to a reference to `Self`
> +    /// when the reference is properly aligned and the size of slice
> +    /// is equal to that of `T` and is different from zero. In another
> +    /// case, it will return `None`.
> +    fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> +    where
> +        Self: AsBytes;
> +}

> +
> +// SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
> +// patterns are also acceptable for arrays of that type.
> +unsafe impl<T: FromBytes> FromBytes for [T] {
> +    fn from_bytes(bytes: &[u8]) -> Option<&Self> {
> +        let size = ::core::mem::size_of::<T>();
> +        build_assert!(size == 0, "Can't create a slice with zero elements");

This message is wrong, it sounds as if the size of `bytes` was zero and
you can definitely create a slice with zero elements.

> +        let slice_ptr = bytes.as_ptr().cast::<T>();
> +        if bytes.len() % size == 0 && slice_ptr.is_aligned() {
> +            // SAFETY: Since the number of elements is different from
> +            // zero and the pointer is aligned, the slice is valid.

Please take a look at the documentation of `from_raw_parts`, there are
several bullet points of safety requirements. Please provide a
justification for each one and also place them in a bullet point list.

---
Cheers,
Benno

> +            unsafe { Some(::core::slice::from_raw_parts(slice_ptr, bytes.len() / size)) }
> +        } else {
> +            None
> +        }
> +    }
> +
> +    fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> +    where
> +        Self: AsBytes,
> +    {
> +        let size = ::core::mem::size_of::<T>();
> +        build_assert!(size == 0, "Can't create a slice with zero elements");
> +        let slice_ptr = bytes.as_mut_ptr().cast::<T>();
> +        if bytes.len() % size == 0 && slice_ptr.is_aligned() {
> +            // SAFETY: Since the number of elements is different from
> +            // zero and the pointer is aligned, the slice is valid.
> +            unsafe {
> +                Some(::core::slice::from_raw_parts_mut(
> +                    slice_ptr,
> +                    bytes.len() / size,
> +                ))
> +            }
> +        } else {
> +            None
> +        }
> +    }
>  }
>  
>  /// Types that can be viewed as an immutable slice of initialized bytes.