Re: [PATCH 1/2] rust: alloc: extend safety requirements of Vec::set_len()

[Alice Ryhl <aliceryhl@google.com>]

On Sat, Mar 15, 2025 at 04:43:01PM +0100, Danilo Krummrich wrote:
> Extend the safety requirements of set_len() to consider the case when
> the new length is smaller than the old length.
> 
> Fixes: 2aac4cd7dae3 ("rust: alloc: implement kernel `Vec` type")
> Signed-off-by: Danilo Krummrich <dakr@kernel.org>
> ---
>  rust/kernel/alloc/kvec.rs | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/rust/kernel/alloc/kvec.rs b/rust/kernel/alloc/kvec.rs
> index ae9d072741ce..8540d9e2b717 100644
> --- a/rust/kernel/alloc/kvec.rs
> +++ b/rust/kernel/alloc/kvec.rs
> @@ -189,7 +189,9 @@ pub fn len(&self) -> usize {
>      ///
>      /// - `new_len` must be less than or equal to [`Self::capacity`].
>      /// - If `new_len` is greater than `self.len`, all elements within the interval
> -    ///   [`self.len`,`new_len`) must be initialized.
> +    ///   [`self.len`,`new_len`) must be initialized,
> +    /// - if `new_len` is smaller than `self.len`, all elements within the interval
> +    ///   [`new_len`, `self.len`) must either be dropped or copied and taken ownership of.

This should not be a safety requirement. How about instead adding a
guarantee to the caller that the caller may safely take ownership of the
values?

Alice