Re: [PATCH v5 02/23] rust: create basic untrusted data API

["Benno Lossin" <lossin@kernel.org>]

On Tue Oct 27, 2026 at 5:34 AM GMT, sashiko-bot wrote:
>> +impl<T> Untrusted<T> {
>> +    /// Marks the data behind the given reference as untrusted.
>> +    ///
>> +    /// Unlike [`Untrusted::new`], this does not require moving the value.
>> +    #[inline]
>> +    pub const fn from_ref(value: &T) -> &Self {
>> +        // SAFETY: `Untrusted<T>` transparently wraps `T`. The cast
>> +        // does not introduce interior mutability, as `Untrusted<T>`
>> +        // has interior mutability if and only if `T` has.
>> +        unsafe { &*from_ref(value).cast::<Self>() }
>> +    }
>> +
>> +    /// Marks the data behind the given mutable reference as untrusted.
>> +    ///
>> +    /// Unlike [`Untrusted::new`], this does not require moving the value.
>> +    #[inline]
>> +    pub const fn from_mut(value: &mut T) -> &mut Self {
>> +        // SAFETY: Same reasoning as `from_ref()`.
>> +        unsafe { &mut *from_mut(value).cast::<Self>() }
>> +    }
>> +
>> +    /// Marks the given slice of data as untrusted.
>> +    #[inline]
>> +    pub const fn from_slice(value: &[T]) -> &[Self] {
>> +        // SAFETY: `Untrusted<T>` transparently wraps `T`. The cast
>> +        // does not introduce interior mutability either, as `Untrusted<T>`
>> +        // has interior mutability if and only if `T` has.
>> +        unsafe { slice::from_raw_parts(value.as_ptr().cast::<Self>(), value.len()) }
>> +    }
>> +
>> +    /// Marks the given mutable slice of data as untrusted.
>> +    #[inline]
>> +    pub const fn from_mut_slice(value: &mut [T]) -> &mut [Self] {
>> +        // SAFETY: Same reasoning as `from_slice()`.
>> +        unsafe { slice::from_raw_parts_mut(value.as_mut_ptr().cast::<Self>(), value.len()) }
>> +    }
>> +}
>
> [Severity: Medium]
> Do public Untrusted::from_mut() and Untrusted::from_mut_slice() allow safe
> code to bypass the opacity guarantee of Untrusted<T>?
>
> Because mutable references are invariant in T, converting &mut T into
> &mut Untrusted<T> (or &mut [T] into &mut [Untrusted<T>]) allows callers to
> write unvalidated Untrusted<T> values directly into a plain, trusted T or [T]
> variable without validation:
>
>     let mut trusted: u8 = 0;
>     *Untrusted::from_mut(&mut trusted) = untrusted_byte;
>
> Similarly, a caller with a plain mutable slice buf: &mut [u8] can pass
> Untrusted::from_mut_slice(buf) to a function expecting &mut [Untrusted<u8>]
> (such as the read_from_userspace(buf: &mut [Untrusted<u8>]) pattern shown in
> the documentation) and then read the unvalidated bytes directly from buf
> after the call returns.
>
> Since DerefMut on Untrusted<[T]> and Untrusted<Vec<T, A>> only converts an
> already-untrusted container into &mut [Untrusted<T>], should from_mut_slice()
> be private and from_mut() be removed or kept private?

this is correct. we should remove `from_mut_slice`. but we can provide
`Vec::from_trusted: fn(Vec<T>) -> Vec<Untrusted<T>>`.

best,
Benno