Re: [PATCH v18 8/8] rust: page: add `from_raw()`

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The `# Safety` documentation for `Page::from_raw` is missing the precondition that `ptr` must point to a valid `struct page`.
--

commit f6aeebdd661d4004190de07e9d991442f793517a
Author: Andreas Hindborg <a.hindborg@kernel.org>

rust: page: add `from_raw()`

This commit adds a from_raw() method to the Page abstraction. It allows
the construction of a shared reference to a Page instance directly from a 
raw struct page pointer.

> diff --git a/rust/kernel/page.rs b/rust/kernel/page.rs
> index 6dc1c2395acaf..c88fda09ead5a 100644
> --- a/rust/kernel/page.rs
> +++ b/rust/kernel/page.rs

[ ... ]

> @@ -143,6 +143,20 @@ pub fn nid(&self) -> i32 {
>          unsafe { bindings::page_to_nid(self.as_ptr()) }
>      }
>  
> +    /// Create a `&Page` from a raw `struct page` pointer.
> +    ///
> +    /// # Safety
> +    ///
> +    /// `ptr` must be convertible to a shared reference with a lifetime of `'a`.
> +    #[inline]
> +    pub unsafe fn from_raw<'a>(ptr: *const bindings::page) -> &'a Self {

[Severity: Medium]
Is the safety documentation missing a requirement here? 

The # Safety section only requires that ptr is convertible to a shared 
reference. Under Rust's rules, an uninitialized or dummy pointer could 
technically be converted to a shared reference if properly aligned.

> +        // INVARIANT: By the function safety requirements, `ptr` refers to a valid `struct page`, so
> +        // the returned reference upholds the type invariant of `Page`.

The invariant justification inside the function explicitly relies on the 
caller guaranteeing that ptr refers to a valid struct page. Could the 
# Safety documentation be updated to explicitly require that ptr points 
to a valid, initialized struct page so that callers do not inadvertently 
violate the Page type invariant?

> +        // SAFETY: By function safety requirements, `ptr` is not null and is convertible to a shared
> +        // reference.
> +        unsafe { &*ptr.cast() }
> +    }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260625-unique-ref-v18-0-4e06b5896d47@kernel.org?part=8