[PATCH] rust: workqueue: replace SAFETY TODO for `WorkItemPointer` impl on `Pin<KBox<T>>`

[PATCH] rust: workqueue: replace SAFETY TODO for `WorkItemPointer` impl on `Pin<KBox<T>>`

[Sagar Taunk]

The original implementation left a `SAFETY: TODO` comment on the
`WorkItemPointer` implementation for `Pin<KBox<T>>`. This patch documents
the safety requirements that make this implementation sound.

The safety argument relies on three guarantees: `__enqueue` strips the
`Pin` wrapper via `Pin::into_inner_unchecked` and leaks the box via
`KBox::into_raw`, producing a `*mut T` whose allocation remains live for
the duration of the queued work; `work_container_of` safely reverses the
`raw_get_work` offset arithmetic to recover the exact `*mut T` that
`__enqueue` produced; and the workqueue guarantees `run` is called exactly
once, making `KBox::from_raw` sound.

Signed-off-by: Sagar Taunk <sagartaunk2@gmail.com>
---
 rust/kernel/workqueue.rs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/rust/kernel/workqueue.rs b/rust/kernel/workqueue.rs
index 74c59f2b1c09..f31412fca303 100644
--- a/rust/kernel/workqueue.rs
+++ b/rust/kernel/workqueue.rs
@@ -881,7 +881,12 @@ unsafe impl<T, const ID: u64> RawDelayedWorkItem<ID> for Arc<T>
 {
 }
 
-// SAFETY: TODO.
+// SAFETY: The `work_struct` pointer passed to `run` originates from `__enqueue`,
+// which strips the `Pin` wrapper via `Pin::into_inner_unchecked()` and leaks the box
+// via `KBox::into_raw()`, producing a `*mut T`. `work_container_of` then safely reverses
+// the `raw_get_work` offset to recover that exact `*mut T`. The workqueue itself guarantees
+// that `run` is called exactly once, so `KBox::from_raw()` correctly reclaims ownership
+// of the leaked box.
 unsafe impl<T, const ID: u64> WorkItemPointer<ID> for Pin<KBox<T>>
 where
     T: WorkItem<ID, Pointer = Self>,
-- 
2.54.0

Re: [PATCH] rust: workqueue: replace SAFETY TODO for `WorkItemPointer` impl on `Pin<KBox<T>>`

[Onur Özkan]

On Thu, 30 Apr 2026 06:18:56 +0530
Sagar Taunk <sagartaunk2@gmail.com> wrote:

> The original implementation left a `SAFETY: TODO` comment on the
> `WorkItemPointer` implementation for `Pin<KBox<T>>`. This patch documents
> the safety requirements that make this implementation sound.
> 
> The safety argument relies on three guarantees: `__enqueue` strips the
> `Pin` wrapper via `Pin::into_inner_unchecked` and leaks the box via
> `KBox::into_raw`, producing a `*mut T` whose allocation remains live for
> the duration of the queued work; `work_container_of` safely reverses the
> `raw_get_work` offset arithmetic to recover the exact `*mut T` that
> `__enqueue` produced; and the workqueue guarantees `run` is called exactly
> once, making `KBox::from_raw` sound.
> 
> Signed-off-by: Sagar Taunk <sagartaunk2@gmail.com>
> ---
>  rust/kernel/workqueue.rs | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/rust/kernel/workqueue.rs b/rust/kernel/workqueue.rs
> index 74c59f2b1c09..f31412fca303 100644
> --- a/rust/kernel/workqueue.rs
> +++ b/rust/kernel/workqueue.rs
> @@ -881,7 +881,12 @@ unsafe impl<T, const ID: u64> RawDelayedWorkItem<ID> for Arc<T>
>  {
>  }
>  
> -// SAFETY: TODO.
> +// SAFETY: The `work_struct` pointer passed to `run` originates from `__enqueue`,
> +// which strips the `Pin` wrapper via `Pin::into_inner_unchecked()` and leaks the box
> +// via `KBox::into_raw()`, producing a `*mut T`. `work_container_of` then safely reverses
> +// the `raw_get_work` offset to recover that exact `*mut T`. The workqueue itself guarantees
> +// that `run` is called exactly once, so `KBox::from_raw()` correctly reclaims ownership
> +// of the leaked box.

Not very human readable (at least for me)... Perhaps you can check the notes
from ARef<T> and Arc<T> impls? It They should have some parts in common like
the initialization part.

- Onur

>  unsafe impl<T, const ID: u64> WorkItemPointer<ID> for Pin<KBox<T>>
>  where
>      T: WorkItem<ID, Pointer = Self>,
> -- 
> 2.54.0
> 

Re: [PATCH] rust: workqueue: replace SAFETY TODO for `WorkItemPointer` impl on `Pin<KBox<T>>`

[Sagar Taunk]

Thank you for the feedback. Are there any other things I should try to
improve in v2?


On Thu, 30 Apr 2026 at 11:29, Onur Özkan <work@onurozkan.dev> wrote:
>
> On Thu, 30 Apr 2026 06:18:56 +0530
> Sagar Taunk <sagartaunk2@gmail.com> wrote:
>
> > The original implementation left a `SAFETY: TODO` comment on the
> > `WorkItemPointer` implementation for `Pin<KBox<T>>`. This patch documents
> > the safety requirements that make this implementation sound.
> >
> > The safety argument relies on three guarantees: `__enqueue` strips the
> > `Pin` wrapper via `Pin::into_inner_unchecked` and leaks the box via
> > `KBox::into_raw`, producing a `*mut T` whose allocation remains live for
> > the duration of the queued work; `work_container_of` safely reverses the
> > `raw_get_work` offset arithmetic to recover the exact `*mut T` that
> > `__enqueue` produced; and the workqueue guarantees `run` is called exactly
> > once, making `KBox::from_raw` sound.
> >
> > Signed-off-by: Sagar Taunk <sagartaunk2@gmail.com>
> > ---
> >  rust/kernel/workqueue.rs | 7 ++++++-
> >  1 file changed, 6 insertions(+), 1 deletion(-)
> >
> > diff --git a/rust/kernel/workqueue.rs b/rust/kernel/workqueue.rs
> > index 74c59f2b1c09..f31412fca303 100644
> > --- a/rust/kernel/workqueue.rs
> > +++ b/rust/kernel/workqueue.rs
> > @@ -881,7 +881,12 @@ unsafe impl<T, const ID: u64> RawDelayedWorkItem<ID> for Arc<T>
> >  {
> >  }
> >
> > -// SAFETY: TODO.
> > +// SAFETY: The `work_struct` pointer passed to `run` originates from `__enqueue`,
> > +// which strips the `Pin` wrapper via `Pin::into_inner_unchecked()` and leaks the box
> > +// via `KBox::into_raw()`, producing a `*mut T`. `work_container_of` then safely reverses
> > +// the `raw_get_work` offset to recover that exact `*mut T`. The workqueue itself guarantees
> > +// that `run` is called exactly once, so `KBox::from_raw()` correctly reclaims ownership
> > +// of the leaked box.
>
> Not very human readable (at least for me)... Perhaps you can check the notes
> from ARef<T> and Arc<T> impls? It They should have some parts in common like
> the initialization part.
>
> - Onur
>
> >  unsafe impl<T, const ID: u64> WorkItemPointer<ID> for Pin<KBox<T>>
> >  where
> >      T: WorkItem<ID, Pointer = Self>,
> > --
> > 2.54.0
> >