[PATCH] rust: disallow use of `CStr::as_ptr`

[PATCH] rust: disallow use of `CStr::as_ptr`

[Gary Guo]

From: Gary Guo <gary@garyguo.net>

As kernel always use unsigned char and not the platform ABI's default, an
user should always use `as_char_ptr` provided via `CStrExt` instead.
Therefore configure `disallow-methods` feature of clippy to catch incorrect
usage.

Signed-off-by: Gary Guo <gary@garyguo.net>
---
 .clippy.toml       | 5 +++++
 rust/kernel/str.rs | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/.clippy.toml b/.clippy.toml
index 137f41d203de..fd934bc04242 100644
--- a/.clippy.toml
+++ b/.clippy.toml
@@ -9,3 +9,8 @@ disallowed-macros = [
     # it here, see: https://github.com/rust-lang/rust-clippy/issues/11303.
     { path = "kernel::dbg", reason = "the `dbg!` macro is intended as a debugging tool", allow-invalid = true },
 ]
+
+[[disallowed-methods]]
+path = "core::ffi::CStr::as_ptr"
+replacement = "kernel::prelude::CStrExt::as_char_ptr"
+reason = "Kernel's `char` is always unsigned. Use `as_char_ptr` instead."
diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
index fa87779d2253..08b8e2ebc8ad 100644
--- a/rust/kernel/str.rs
+++ b/rust/kernel/str.rs
@@ -189,6 +189,7 @@ macro_rules! b_str {
 //
 // - error[E0379]: functions in trait impls cannot be declared const
 #[inline]
+#[expect(clippy::disallowed_methods, reason = "internal implementation")]
 pub const fn as_char_ptr_in_const_context(c_str: &CStr) -> *const c_char {
     c_str.as_ptr().cast()
 }
@@ -334,6 +335,7 @@ unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut Self {
     }
 
     #[inline]
+    #[expect(clippy::disallowed_methods, reason = "internal implementation")]
     fn as_char_ptr(&self) -> *const c_char {
         self.as_ptr().cast()
     }

-- 
2.51.2

Re: [PATCH] rust: disallow use of `CStr::as_ptr`

[Miguel Ojeda]

On Wed, Jan 21, 2026 at 5:58 PM Gary Guo <gary@kernel.org> wrote:
>
> +#[expect(clippy::disallowed_methods, reason = "internal implementation")]

Should we hide them too?

Cheers,
Miguel

Re: [PATCH] rust: disallow use of `CStr::as_ptr`

[Gary Guo]

On Wed Jan 21, 2026 at 5:04 PM GMT, Miguel Ojeda wrote:
> On Wed, Jan 21, 2026 at 5:58 PM Gary Guo <gary@kernel.org> wrote:
>>
>> +#[expect(clippy::disallowed_methods, reason = "internal implementation")]
>
> Should we hide them too?

These are the methods that we want people to use? The "internal implementation"
means that the use of `CStr::as_char()` is the internal implementation detail of
`as_char_ptr` so it's okay. But nobody else should use it.

Best,
Gary

>
> Cheers,
> Miguel

Re: [PATCH] rust: disallow use of `CStr::as_ptr`

[Miguel Ojeda]

On Wed, Jan 21, 2026 at 6:33 PM Gary Guo <gary@garyguo.net> wrote:
>
> These are the methods that we want people to use? The "internal implementation"
> means that the use of `CStr::as_char()` is the internal implementation detail of
> `as_char_ptr` so it's okay. But nobody else should use it.

Yeah, not sure how I read that, sorry. And obviously we can't (easily)
add it to `core` one.

Cheers,
Miguel

Re: [PATCH] rust: disallow use of `CStr::as_ptr`

[Tamir Duberstein]

On Wed, Jan 21, 2026 at 11:58 AM Gary Guo <gary@kernel.org> wrote:
>
> From: Gary Guo <gary@garyguo.net>
>
> As kernel always use unsigned char and not the platform ABI's default, an
> user should always use `as_char_ptr` provided via `CStrExt` instead.
> Therefore configure `disallow-methods` feature of clippy to catch incorrect
> usage.
>
> Signed-off-by: Gary Guo <gary@garyguo.net>
> ---
>  .clippy.toml       | 5 +++++
>  rust/kernel/str.rs | 2 ++
>  2 files changed, 7 insertions(+)
>
> diff --git a/.clippy.toml b/.clippy.toml
> index 137f41d203de..fd934bc04242 100644
> --- a/.clippy.toml
> +++ b/.clippy.toml
> @@ -9,3 +9,8 @@ disallowed-macros = [
>      # it here, see: https://github.com/rust-lang/rust-clippy/issues/11303.
>      { path = "kernel::dbg", reason = "the `dbg!` macro is intended as a debugging tool", allow-invalid = true },
>  ]
> +
> +[[disallowed-methods]]
> +path = "core::ffi::CStr::as_ptr"
> +replacement = "kernel::prelude::CStrExt::as_char_ptr"
> +reason = "Kernel's `char` is always unsigned. Use `as_char_ptr` instead."

In the disallowed-macros section above we seem to use sentence
fragments (no capitalization, no trailing period).

> diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
> index fa87779d2253..08b8e2ebc8ad 100644
> --- a/rust/kernel/str.rs
> +++ b/rust/kernel/str.rs
> @@ -189,6 +189,7 @@ macro_rules! b_str {
>  //
>  // - error[E0379]: functions in trait impls cannot be declared const
>  #[inline]
> +#[expect(clippy::disallowed_methods, reason = "internal implementation")]
>  pub const fn as_char_ptr_in_const_context(c_str: &CStr) -> *const c_char {
>      c_str.as_ptr().cast()
>  }
> @@ -334,6 +335,7 @@ unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut Self {
>      }
>
>      #[inline]
> +    #[expect(clippy::disallowed_methods, reason = "internal implementation")]

Can this be inside the function, on the `as_ptr` call itself?

>      fn as_char_ptr(&self) -> *const c_char {
>          self.as_ptr().cast()
>      }
>
> --
> 2.51.2
>

Acked-by: Tamir Duberstein <tamird@kernel.org>

Re: [PATCH] rust: disallow use of `CStr::as_ptr`

[Gary Guo]

On Wed Jan 21, 2026 at 5:55 PM GMT, Tamir Duberstein wrote:
> On Wed, Jan 21, 2026 at 11:58 AM Gary Guo <gary@kernel.org> wrote:
>>
>> From: Gary Guo <gary@garyguo.net>
>>
>> As kernel always use unsigned char and not the platform ABI's default, an
>> user should always use `as_char_ptr` provided via `CStrExt` instead.
>> Therefore configure `disallow-methods` feature of clippy to catch incorrect
>> usage.
>>
>> Signed-off-by: Gary Guo <gary@garyguo.net>
>> ---
>>  .clippy.toml       | 5 +++++
>>  rust/kernel/str.rs | 2 ++
>>  2 files changed, 7 insertions(+)
>>
>> diff --git a/.clippy.toml b/.clippy.toml
>> index 137f41d203de..fd934bc04242 100644
>> --- a/.clippy.toml
>> +++ b/.clippy.toml
>> @@ -9,3 +9,8 @@ disallowed-macros = [
>>      # it here, see: https://github.com/rust-lang/rust-clippy/issues/11303.
>>      { path = "kernel::dbg", reason = "the `dbg!` macro is intended as a debugging tool", allow-invalid = true },
>>  ]
>> +
>> +[[disallowed-methods]]
>> +path = "core::ffi::CStr::as_ptr"
>> +replacement = "kernel::prelude::CStrExt::as_char_ptr"
>> +reason = "Kernel's `char` is always unsigned. Use `as_char_ptr` instead."
>
> In the disallowed-macros section above we seem to use sentence
> fragments (no capitalization, no trailing period).

Ok.

>
>> diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
>> index fa87779d2253..08b8e2ebc8ad 100644
>> --- a/rust/kernel/str.rs
>> +++ b/rust/kernel/str.rs
>> @@ -189,6 +189,7 @@ macro_rules! b_str {
>>  //
>>  // - error[E0379]: functions in trait impls cannot be declared const
>>  #[inline]
>> +#[expect(clippy::disallowed_methods, reason = "internal implementation")]
>>  pub const fn as_char_ptr_in_const_context(c_str: &CStr) -> *const c_char {
>>      c_str.as_ptr().cast()
>>  }
>> @@ -334,6 +335,7 @@ unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut Self {
>>      }
>>
>>      #[inline]
>> +    #[expect(clippy::disallowed_methods, reason = "internal implementation")]
>
> Can this be inside the function, on the `as_ptr` call itself?

You cannot apply attributes on expressions (yet). If this is to be moved into
the function, there needs an additional block, which I think is just
unnecessary.

Best,
Gary

>
>>      fn as_char_ptr(&self) -> *const c_char {
>>          self.as_ptr().cast()
>>      }
>>
>> --
>> 2.51.2
>>
>
> Acked-by: Tamir Duberstein <tamird@kernel.org>

Re: [PATCH] rust: disallow use of `CStr::as_ptr`

[Tamir Duberstein]

On Wed, Jan 21, 2026 at 2:38 PM Gary Guo <gary@garyguo.net> wrote:
>
> On Wed Jan 21, 2026 at 5:55 PM GMT, Tamir Duberstein wrote:
> > On Wed, Jan 21, 2026 at 11:58 AM Gary Guo <gary@kernel.org> wrote:
> >>
> >> From: Gary Guo <gary@garyguo.net>
> >>
> >> As kernel always use unsigned char and not the platform ABI's default, an
> >> user should always use `as_char_ptr` provided via `CStrExt` instead.
> >> Therefore configure `disallow-methods` feature of clippy to catch incorrect
> >> usage.
> >>
> >> Signed-off-by: Gary Guo <gary@garyguo.net>
> >> ---
> >>  .clippy.toml       | 5 +++++
> >>  rust/kernel/str.rs | 2 ++
> >>  2 files changed, 7 insertions(+)
> >>
> >> diff --git a/.clippy.toml b/.clippy.toml
> >> index 137f41d203de..fd934bc04242 100644
> >> --- a/.clippy.toml
> >> +++ b/.clippy.toml
> >> @@ -9,3 +9,8 @@ disallowed-macros = [
> >>      # it here, see: https://github.com/rust-lang/rust-clippy/issues/11303.
> >>      { path = "kernel::dbg", reason = "the `dbg!` macro is intended as a debugging tool", allow-invalid = true },
> >>  ]
> >> +
> >> +[[disallowed-methods]]
> >> +path = "core::ffi::CStr::as_ptr"
> >> +replacement = "kernel::prelude::CStrExt::as_char_ptr"
> >> +reason = "Kernel's `char` is always unsigned. Use `as_char_ptr` instead."
> >
> > In the disallowed-macros section above we seem to use sentence
> > fragments (no capitalization, no trailing period).
>
> Ok.
>
> >
> >> diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
> >> index fa87779d2253..08b8e2ebc8ad 100644
> >> --- a/rust/kernel/str.rs
> >> +++ b/rust/kernel/str.rs
> >> @@ -189,6 +189,7 @@ macro_rules! b_str {
> >>  //
> >>  // - error[E0379]: functions in trait impls cannot be declared const
> >>  #[inline]
> >> +#[expect(clippy::disallowed_methods, reason = "internal implementation")]
> >>  pub const fn as_char_ptr_in_const_context(c_str: &CStr) -> *const c_char {
> >>      c_str.as_ptr().cast()
> >>  }
> >> @@ -334,6 +335,7 @@ unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut Self {
> >>      }
> >>
> >>      #[inline]
> >> +    #[expect(clippy::disallowed_methods, reason = "internal implementation")]
> >
> > Can this be inside the function, on the `as_ptr` call itself?
>
> You cannot apply attributes on expressions (yet). If this is to be moved into
> the function, there needs an additional block, which I think is just
> unnecessary.

Thought so. Should we add a TODO that links to the relevant upstream
issue, or track it in
https://github.com/Rust-for-Linux/linux/issues/2?

>
> Best,
> Gary
>
> >
> >>      fn as_char_ptr(&self) -> *const c_char {
> >>          self.as_ptr().cast()
> >>      }
> >>
> >> --
> >> 2.51.2
> >>
> >
> > Acked-by: Tamir Duberstein <tamird@kernel.org>
>
>

Re: [PATCH] rust: disallow use of `CStr::as_ptr`

[Gary Guo]

On Wed Jan 21, 2026 at 7:45 PM GMT, Tamir Duberstein wrote:
> On Wed, Jan 21, 2026 at 2:38 PM Gary Guo <gary@garyguo.net> wrote:
>>
>> On Wed Jan 21, 2026 at 5:55 PM GMT, Tamir Duberstein wrote:
>> > On Wed, Jan 21, 2026 at 11:58 AM Gary Guo <gary@kernel.org> wrote:
>> >>
>> >> From: Gary Guo <gary@garyguo.net>
>> >>
>> >> As kernel always use unsigned char and not the platform ABI's default, an
>> >> user should always use `as_char_ptr` provided via `CStrExt` instead.
>> >> Therefore configure `disallow-methods` feature of clippy to catch incorrect
>> >> usage.
>> >>
>> >> Signed-off-by: Gary Guo <gary@garyguo.net>
>> >> ---
>> >>  .clippy.toml       | 5 +++++
>> >>  rust/kernel/str.rs | 2 ++
>> >>  2 files changed, 7 insertions(+)
>> >>
>> >> diff --git a/.clippy.toml b/.clippy.toml
>> >> index 137f41d203de..fd934bc04242 100644
>> >> --- a/.clippy.toml
>> >> +++ b/.clippy.toml
>> >> @@ -9,3 +9,8 @@ disallowed-macros = [
>> >>      # it here, see: https://github.com/rust-lang/rust-clippy/issues/11303.
>> >>      { path = "kernel::dbg", reason = "the `dbg!` macro is intended as a debugging tool", allow-invalid = true },
>> >>  ]
>> >> +
>> >> +[[disallowed-methods]]
>> >> +path = "core::ffi::CStr::as_ptr"
>> >> +replacement = "kernel::prelude::CStrExt::as_char_ptr"
>> >> +reason = "Kernel's `char` is always unsigned. Use `as_char_ptr` instead."
>> >
>> > In the disallowed-macros section above we seem to use sentence
>> > fragments (no capitalization, no trailing period).
>>
>> Ok.
>>
>> >
>> >> diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
>> >> index fa87779d2253..08b8e2ebc8ad 100644
>> >> --- a/rust/kernel/str.rs
>> >> +++ b/rust/kernel/str.rs
>> >> @@ -189,6 +189,7 @@ macro_rules! b_str {
>> >>  //
>> >>  // - error[E0379]: functions in trait impls cannot be declared const
>> >>  #[inline]
>> >> +#[expect(clippy::disallowed_methods, reason = "internal implementation")]
>> >>  pub const fn as_char_ptr_in_const_context(c_str: &CStr) -> *const c_char {
>> >>      c_str.as_ptr().cast()
>> >>  }
>> >> @@ -334,6 +335,7 @@ unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut Self {
>> >>      }
>> >>
>> >>      #[inline]
>> >> +    #[expect(clippy::disallowed_methods, reason = "internal implementation")]
>> >
>> > Can this be inside the function, on the `as_ptr` call itself?
>>
>> You cannot apply attributes on expressions (yet). If this is to be moved into
>> the function, there needs an additional block, which I think is just
>> unnecessary.
>
> Thought so. Should we add a TODO that links to the relevant upstream
> issue, or track it in
> https://github.com/Rust-for-Linux/linux/issues/2?

I don't think we really this need this.

If Miguel thinks this is useful then he can add it to the tracking issue.

Best,
Gary

>>
>> >
>> >>      fn as_char_ptr(&self) -> *const c_char {
>> >>          self.as_ptr().cast()
>> >>      }
>> >>
>> >> --
>> >> 2.51.2
>> >>
>> >
>> > Acked-by: Tamir Duberstein <tamird@kernel.org>
>>
>>

Re: [PATCH] rust: disallow use of `CStr::as_ptr`

[Tamir Duberstein]

On Wed, Jan 21, 2026 at 3:01 PM Gary Guo <gary@garyguo.net> wrote:
>
> On Wed Jan 21, 2026 at 7:45 PM GMT, Tamir Duberstein wrote:
> > On Wed, Jan 21, 2026 at 2:38 PM Gary Guo <gary@garyguo.net> wrote:
> >>
> >> On Wed Jan 21, 2026 at 5:55 PM GMT, Tamir Duberstein wrote:
> >> > On Wed, Jan 21, 2026 at 11:58 AM Gary Guo <gary@kernel.org> wrote:
> >> >>
> >> >> From: Gary Guo <gary@garyguo.net>
> >> >>
> >> >> As kernel always use unsigned char and not the platform ABI's default, an
> >> >> user should always use `as_char_ptr` provided via `CStrExt` instead.
> >> >> Therefore configure `disallow-methods` feature of clippy to catch incorrect
> >> >> usage.
> >> >>
> >> >> Signed-off-by: Gary Guo <gary@garyguo.net>
> >> >> ---
> >> >>  .clippy.toml       | 5 +++++
> >> >>  rust/kernel/str.rs | 2 ++
> >> >>  2 files changed, 7 insertions(+)
> >> >>
> >> >> diff --git a/.clippy.toml b/.clippy.toml
> >> >> index 137f41d203de..fd934bc04242 100644
> >> >> --- a/.clippy.toml
> >> >> +++ b/.clippy.toml
> >> >> @@ -9,3 +9,8 @@ disallowed-macros = [
> >> >>      # it here, see: https://github.com/rust-lang/rust-clippy/issues/11303.
> >> >>      { path = "kernel::dbg", reason = "the `dbg!` macro is intended as a debugging tool", allow-invalid = true },
> >> >>  ]
> >> >> +
> >> >> +[[disallowed-methods]]
> >> >> +path = "core::ffi::CStr::as_ptr"
> >> >> +replacement = "kernel::prelude::CStrExt::as_char_ptr"
> >> >> +reason = "Kernel's `char` is always unsigned. Use `as_char_ptr` instead."
> >> >
> >> > In the disallowed-macros section above we seem to use sentence
> >> > fragments (no capitalization, no trailing period).
> >>
> >> Ok.
> >>
> >> >
> >> >> diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
> >> >> index fa87779d2253..08b8e2ebc8ad 100644
> >> >> --- a/rust/kernel/str.rs
> >> >> +++ b/rust/kernel/str.rs
> >> >> @@ -189,6 +189,7 @@ macro_rules! b_str {
> >> >>  //
> >> >>  // - error[E0379]: functions in trait impls cannot be declared const
> >> >>  #[inline]
> >> >> +#[expect(clippy::disallowed_methods, reason = "internal implementation")]
> >> >>  pub const fn as_char_ptr_in_const_context(c_str: &CStr) -> *const c_char {
> >> >>      c_str.as_ptr().cast()
> >> >>  }
> >> >> @@ -334,6 +335,7 @@ unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut Self {
> >> >>      }
> >> >>
> >> >>      #[inline]
> >> >> +    #[expect(clippy::disallowed_methods, reason = "internal implementation")]
> >> >
> >> > Can this be inside the function, on the `as_ptr` call itself?
> >>
> >> You cannot apply attributes on expressions (yet). If this is to be moved into
> >> the function, there needs an additional block, which I think is just
> >> unnecessary.
> >
> > Thought so. Should we add a TODO that links to the relevant upstream
> > issue, or track it in
> > https://github.com/Rust-for-Linux/linux/issues/2?
>
> I don't think we really this need this.
>
> If Miguel thinks this is useful then he can add it to the tracking issue.

Well, what is "it"? Do you know the upstream issue?

>
> Best,
> Gary
>
> >>
> >> >
> >> >>      fn as_char_ptr(&self) -> *const c_char {
> >> >>          self.as_ptr().cast()
> >> >>      }
> >> >>
> >> >> --
> >> >> 2.51.2
> >> >>
> >> >
> >> > Acked-by: Tamir Duberstein <tamird@kernel.org>
> >>
> >>
>

Re: [PATCH] rust: disallow use of `CStr::as_ptr`

[Miguel Ojeda]

On Wed, Jan 21, 2026 at 9:02 PM Tamir Duberstein <tamird@kernel.org> wrote:
>
> Well, what is "it"? Do you know the upstream issue?

I think Gary is referring to this one:

    https://github.com/rust-lang/rust/issues/15701

We have had several times where we could have used attributes for
`allow`s and `cfg`s and such.

I think it is fair to add it to the wishlist (i.e.
https://github.com/Rust-for-Linux/linux/issues/354).

Cheers,
Miguel

Re: [PATCH] rust: disallow use of `CStr::as_ptr`

[Alice Ryhl]

On Wed, Jan 21, 2026 at 04:58:14PM +0000, Gary Guo wrote:
> From: Gary Guo <gary@garyguo.net>
> 
> As kernel always use unsigned char and not the platform ABI's default, an
> user should always use `as_char_ptr` provided via `CStrExt` instead.
> Therefore configure `disallow-methods` feature of clippy to catch incorrect
> usage.
> 
> Signed-off-by: Gary Guo <gary@garyguo.net>

Reviewed-by: Alice Ryhl <aliceryhl@google.com>

Re: [PATCH] rust: disallow use of `CStr::as_ptr`

[kernel test robot]

Hi Gary,

kernel test robot noticed the following build warnings:

[auto build test WARNING on rust/rust-next]
[also build test WARNING on next-20260121]
[cannot apply to linus/master v6.16-rc1]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Gary-Guo/rust-disallow-use-of-CStr-as_ptr/20260122-014335
base:   https://github.com/Rust-for-Linux/linux rust-next
patch link:    https://lore.kernel.org/r/20260121165835.4097975-1-gary%40kernel.org
patch subject: [PATCH] rust: disallow use of `CStr::as_ptr`
config: x86_64-rhel-9.4-rust (https://download.01.org/0day-ci/archive/20260122/202601221157.89t3Sqbl-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
rustc: rustc 1.88.0 (6b00bc388 2025-06-23)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260122/202601221157.89t3Sqbl-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202601221157.89t3Sqbl-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> warning: use of a disallowed method `core::ffi::CStr::as_ptr`
   --> rust/kernel/task.rs:422:54
   |
   422 |         unsafe { crate::bindings::__might_sleep(file.as_ptr().cast(), loc.line() as i32) }
   |                                                      ^^^^^^ help: Kernel's `char` is always unsigned. Use `as_char_ptr` instead.: `kernel::prelude::CStrExt::as_char_ptr`
   |
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#disallowed_methods
   = note: `-W clippy::disallowed-methods` implied by `-W clippy::all`
   = help: to override `-W clippy::all` add `#[allow(clippy::disallowed_methods)]`

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki