Re: [PATCH v3 02/21] rust: create basic untrusted data API

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Undefined Behavior due to missing layout guarantees when transmuting `Vec<T, A>` to `Vec<Untrusted<T>, A>`.
- [Low] Small abstraction functions in the `kernel` crate are missing `#[inline]` annotations.
--

commit a2ef24201e92da02db41c39bbc750b20f5e2ce5b
Author: Benno Lossin <lossin@kernel.org>

rust: create basic untrusted data API

This commit introduces an Untrusted<T> wrapper type to explicitly mark
and validate external data before use. The API provides Deref and DerefMut
implementations to allow working with untrusted slices and vectors.

> diff --git a/rust/kernel/validate.rs b/rust/kernel/validate.rs
> new file mode 100644
> index 0000000000000..2b28625c25efe
> --- /dev/null
> +++ b/rust/kernel/validate.rs

[ ... ]

> +impl<T: ?Sized> Untrusted<T> {

[ ... ]

> +    pub fn new(value: T) -> Self
> +    where
> +        T: Sized,
> +    {
> +        Self(value)
> +    }

[Severity: Low]
Could this small abstraction function be annotated with #[inline]?

The Rust Subsystem coding guidelines suggest that small functions in
abstractions like the kernel crate should be marked as inline to ensure
optimal code generation.

> +}
> +
> +impl<T> Deref for Untrusted<[T]> {
> +    type Target = [Untrusted<T>];
> +
> +    fn deref(&self) -> &Self::Target {
> +        // SAFETY: `Untrusted<T>` transparently wraps `T`.
> +        unsafe { cast_slice(&self.0) }
> +    }
> +}

[Severity: Low]
Should this small trait method also have an #[inline] annotation?

> +
> +impl<T> DerefMut for Untrusted<[T]> {
> +    fn deref_mut(&mut self) -> &mut Self::Target {
> +        // SAFETY: `Untrusted<T>` transparently wraps `T`.
> +        unsafe { cast_slice_mut(&mut self.0) }
> +    }
> +}

[Severity: Low]
Would an #[inline] annotation be appropriate for this deref_mut implementation
as well?

> +
> +impl<T, A: Allocator> Deref for Untrusted<Vec<T, A>> {
> +    type Target = Vec<Untrusted<T>, A>;
> +
> +    fn deref(&self) -> &Self::Target {
> +        let ptr: *const Untrusted<Vec<T, A>> = self;
> +        // CAST: `Untrusted<T>` transparently wraps `T`.
> +        let ptr: *const Vec<Untrusted<T>, A> = ptr.cast();
> +        // SAFETY: `ptr` is derived from the reference `self`.
> +        unsafe { &*ptr }
> +    }
> +}

[Severity: High]
Is it possible to add an #[inline] annotation here?

Additionally, does this pointer cast rely on layout guarantees that the
compiler does not provide?

Vec is a #[repr(Rust)] type, which does not guarantee stable or identical
layouts across different generic monomorphizations. Even though Untrusted<T>
is #[repr(transparent)] over T, Vec<T, A> and Vec<Untrusted<T>, A> are
distinct monomorphizations.

If the compiler orders the internal fields differently, transmuting between
these types could lead to memory corruption. The standard way to soundly
convert a vector's element type is by deconstructing it via into_raw_parts
and reconstructing it with from_raw_parts, but this cannot be done for
references.

Are there alternative ways to expose this untrusted vector data safely?

> +
> +impl<T, A: Allocator> DerefMut for Untrusted<Vec<T, A>> {
> +    fn deref_mut(&mut self) -> &mut Self::Target {
> +        let ptr: *mut Untrusted<Vec<T, A>> = self;
> +        // CAST: `Untrusted<T>` transparently wraps `T`.
> +        let ptr: *mut Vec<Untrusted<T>, A> = ptr.cast();
> +        // SAFETY: `ptr` is derived from the reference `self`.
> +        unsafe { &mut *ptr }
> +    }
> +}

[Severity: High]
Could this method be annotated with #[inline] as well?

Similar to the deref implementation above, can this pointer cast invoke
undefined behavior by transmuting between two distinct #[repr(Rust)] types?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901010347.2614656-1-alistair.francis@wdc.com?part=2