Re: [PATCH v6 20/25] rust: public_key: Add crypto public key bindings

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [Low] rust: public_key: missing Invariants and incomplete Safety in
  from_raw()
- [Low] rust: public_key: split kernel import blocks violate vertical
  import style
--

commit 5a9f44bbde86bec3d5be61549a4f56d64bb30ac2
Author: Alistair Francis <alistair.francis@wdc.com>

rust: public_key: Add crypto public key bindings

This commit adds Rust bindings and a PublicKey wrapper for the kernel
crypto public key APIs, providing PublicKey::from_raw(),
PublicKey::verify_signature(), and a Drop implementation.

> diff --git a/rust/kernel/public_key.rs b/rust/kernel/public_key.rs
> new file mode 100644
> index 0000000000000..0c0d4c98bb570
> --- /dev/null
> +++ b/rust/kernel/public_key.rs
> @@ -0,0 +1,83 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +// Copyright (C) 2026 Western Digital
> +
> +//! Wrappers around the Linux kernel crypto public key APIs.
> +//!
> +//! C headers: [`include/crypto/public_key.h`](srctree/include/crypto/public_key.h).
> +//!
> +//! Reference: <https://www.kernel.org/doc/html/latest/crypto/asymmetric-keys.html>
> +
> +use core::ptr::NonNull;
> +use kernel::prelude::*;
> +use kernel::{
> +    bindings,
> +    error::to_result, //
> +};

[Severity: Low]
This isn't a bug, but the two kernel crate imports can be combined into a
single vertical import block per Documentation/rust/coding-guidelines.rst.

> +
> +/// Owned `struct public_key` wrapper.
> +pub struct PublicKey {
> +    key: NonNull<bindings::public_key>,
> +}
> +
> +impl PublicKey {
> +    /// Create a Rust `PublicKey` from a valid C `struct public_key` pointer.
> +    ///
> +    /// # Safety
> +    ///
> +    /// `key` must point to a valid, exclusively-owned `struct public_key`
> +    /// whose ownership is transferred to the returned `PublicKey`. The key
> +    /// is freed with `public_key_free()` when the `PublicKey` is dropped,
> +    /// so the caller must not free it itself or pass the same pointer to
> +    /// `from_raw()` again.
> +    #[inline]
> +    pub unsafe fn from_raw(key: NonNull<bindings::public_key>) -> Self {
> +        Self { key }
> +    }
> +
> +    /// Verify a signature using this public key.
> +    #[inline]
> +    pub fn verify_signature(
> +        &self,
> +        signature: &[u8],
> +        encoding: &'static CStr,
> +        hash_algo: &'static CStr,
> +        message: &[u8],
> +    ) -> Result {
> +        // SAFETY: `self.key` is valid per the struct invariants; its
> +        // `pkey_algo` is populated by the key parser.
> +        let pkey_algo = unsafe { (*self.key.as_ptr()).pkey_algo };

[Severity: Low]
Should PublicKey document an # Invariants section and PublicKey::from_raw()
require those invariants in its # Safety section (with a matching
// INVARIANT: comment in from_raw())?

verify_signature() cites struct invariants for self.key and pkey_algo that
are not documented on PublicKey, and public_key_verify_signature() and
public_key_free() also require pkey_algo to be a valid NUL-terminated string
and key (keylen bytes), params (paramlen bytes), and the struct public_key
itself to be valid kmalloc allocations.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110041832.1730924-1-alistair.francis@wdc.com?part=20