Re: [PATCH v3] rust: num: restrict bool conversion to unsigned Bounded

["Alexandre Courbot" <acourbot@nvidia.com>]

On Sun Aug 16, 2026 at 5:12 AM JST, Younes Akhouayri via B4 Relay wrote:
> From: Younes Akhouayri <git@younes.io>
>
> From<bool> turns true into 1. A signed Bounded with N = 1 can hold
> only -1 and 0. The current implementation can therefore create a value
> that breaks Bounded's invariant. Deref relies on that invariant and
> calls unreachable_unchecked() when it is broken, so safe Rust can reach
> undefined behavior.
>
> The other primitive conversions require the source and destination to
> have the same signedness. Treat bool as an unsigned one-bit value and
> allow this conversion only for unsigned Bounded types.
>
> Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type")
> Closes: https://lore.kernel.org/rust-for-linux/OzuVxu0--J-9@younes.io/
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Younes Akhouayri <git@younes.io>

Thanks, I think this looks good and limiting the conversion to unsigneds
is reasonable. If a signed Bounded is needed, the caller can always
perform another conversion step.

Just one question below.

> ---
> Only allow From<bool> for unsigned Bounded types.
> ---
> Changes in v3:
> - Restrict From<bool> to unsigned Bounded types, matching the other
>   primitive conversions.
> - Remove the BoolFits helper and signed-width list.
> - Link to v2: https://lore.kernel.org/rust-for-linux/20260815-fix-rust-bounded-from-bool-submit-v2-1-aa35bb2c22d1@younes.io/
>
> Changes in v2:
> - Use vertical formatting for the nested `num` import.
> - Link to v1: https://lore.kernel.org/rust-for-linux/20260815-fix-rust-bounded-from-bool-submit-v1-1-882227bf40ba@younes.io/
> ---
>  rust/kernel/num/bounded.rs | 20 ++++++++++++++------
>  1 file changed, 14 insertions(+), 6 deletions(-)
>
> diff --git a/rust/kernel/num/bounded.rs b/rust/kernel/num/bounded.rs
> index d192610a687d..f2413dc7458b 100644
> --- a/rust/kernel/num/bounded.rs
> +++ b/rust/kernel/num/bounded.rs
> @@ -13,7 +13,10 @@
>  };
>  
>  use kernel::{
> -    num::Integer,
> +    num::{
> +        Integer,
> +        Unsigned, //
> +    },
>      prelude::*, //
>  };
>  
> @@ -174,13 +177,16 @@ fn fits_within<T: Integer>(value: T, num_bits: u32) -> bool {
>  /// // `u8` (regardless of the passed value).
>  /// // let _ = Bounded::<u32, 6>::from(10u8);
>  ///
> -/// // Booleans can be converted into single-bit `Bounded`s.
> +/// // Booleans can be converted into unsigned `Bounded`s.
>  ///
>  /// let v = Bounded::<u64, 1>::from(false);
>  /// assert_eq!(v.get(), 0);
>  ///
>  /// let v = Bounded::<u64, 1>::from(true);
>  /// assert_eq!(v.get(), 1);
> +///
> +/// // This does not build because `i8` is signed.
> +/// // let _ = Bounded::<i8, 2>::from(true);
>  /// ```
>  ///
>  /// Infallible conversions from a [`Bounded`] to a primitive integer are also supported, and
> @@ -1109,7 +1115,7 @@ fn from(value: Bounded<T, N>) -> $type {
>      i8 i16 i32 i64 isize
>  );
>  
> -// Single-bit `Bounded`s can be converted from/to a boolean.
> +// Single-bit `Bounded`s can be converted to a boolean.

Since the `From` direction is now limited to unsigned `Bounded`s, maybe
this conversion should as well?