Re: [PATCH] rust: workqueue: replace SAFETY TODO for `WorkItemPointer` impl on `Pin<KBox<T>>`

["Onur Özkan" <work@onurozkan.dev>]

On Thu, 30 Apr 2026 06:18:56 +0530
Sagar Taunk <sagartaunk2@gmail.com> wrote:

> The original implementation left a `SAFETY: TODO` comment on the
> `WorkItemPointer` implementation for `Pin<KBox<T>>`. This patch documents
> the safety requirements that make this implementation sound.
> 
> The safety argument relies on three guarantees: `__enqueue` strips the
> `Pin` wrapper via `Pin::into_inner_unchecked` and leaks the box via
> `KBox::into_raw`, producing a `*mut T` whose allocation remains live for
> the duration of the queued work; `work_container_of` safely reverses the
> `raw_get_work` offset arithmetic to recover the exact `*mut T` that
> `__enqueue` produced; and the workqueue guarantees `run` is called exactly
> once, making `KBox::from_raw` sound.
> 
> Signed-off-by: Sagar Taunk <sagartaunk2@gmail.com>
> ---
>  rust/kernel/workqueue.rs | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/rust/kernel/workqueue.rs b/rust/kernel/workqueue.rs
> index 74c59f2b1c09..f31412fca303 100644
> --- a/rust/kernel/workqueue.rs
> +++ b/rust/kernel/workqueue.rs
> @@ -881,7 +881,12 @@ unsafe impl<T, const ID: u64> RawDelayedWorkItem<ID> for Arc<T>
>  {
>  }
>  
> -// SAFETY: TODO.
> +// SAFETY: The `work_struct` pointer passed to `run` originates from `__enqueue`,
> +// which strips the `Pin` wrapper via `Pin::into_inner_unchecked()` and leaks the box
> +// via `KBox::into_raw()`, producing a `*mut T`. `work_container_of` then safely reverses
> +// the `raw_get_work` offset to recover that exact `*mut T`. The workqueue itself guarantees
> +// that `run` is called exactly once, so `KBox::from_raw()` correctly reclaims ownership
> +// of the leaked box.

Not very human readable (at least for me)... Perhaps you can check the notes
from ARef<T> and Arc<T> impls? It They should have some parts in common like
the initialization part.

- Onur

>  unsafe impl<T, const ID: u64> WorkItemPointer<ID> for Pin<KBox<T>>
>  where
>      T: WorkItem<ID, Pointer = Self>,
> -- 
> 2.54.0
>