[PATCH v2] rust: add safety comment in rust_fmt_argument

[Konstantin Andrikopoulos <kernel@mandragore.io>]

The function rust_fmt_argument dereferences a pointer, and thus it
needs an unsafe block. The safety comment for that block was missing.

Link: https://github.com/Rust-for-Linux/linux/issues/351.

Signed-off-by: Konstantin Andrikopoulos <kernel@mandragore.io>
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
---
 rust/kernel/print.rs | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/rust/kernel/print.rs b/rust/kernel/print.rs
index a28077a7cb30..57a4fc48bbcd 100644
--- a/rust/kernel/print.rs
+++ b/rust/kernel/print.rs
@@ -13,8 +13,27 @@
 
 use crate::str::RawFormatter;
 
-// Called from `vsprintf` with format specifier `%pA`.
-#[expect(clippy::missing_safety_doc)]
+/// Handles the `%pA` format specifier.
+///
+/// This function is called by [`vsprintf`] when it encounters a `%pA` format specifier in a
+/// format string. `ptr` points to the corresponding argument, `buf` points to a buffer to hold
+/// the formatted argument, and `end` points at the buffer's end.
+///
+/// `rust_fmt_argument` treats `ptr` as a pointer to a [`core::fmt::Arguments`], which it formats,
+/// and writes the result to `buf`.
+///
+/// It returns the address after the last byte it has written in `buf`.
+///
+/// # Safety
+///
+/// `buf` and `end` must follow the requirements of [`RawFormatter`]. `ptr` must be valid for
+/// reading a [`core::fmt::Arguments`].
+///
+/// `vsprintf` guarantees that `buf` and `end` will uphold their requirements. However, it will
+/// just forward the argument that corresponds to `%pA`. Callers that provide format strings must
+/// guarantee that arguments which correspond to `%pA` are valid pointers.
+///
+/// [`vsprintf`]: srctree/lib/vsprintf.c
 #[no_mangle]
 unsafe extern "C" fn rust_fmt_argument(
     buf: *mut c_char,
@@ -24,7 +43,8 @@
     use fmt::Write;
     // SAFETY: The C contract guarantees that `buf` is valid if it's less than `end`.
     let mut w = unsafe { RawFormatter::from_ptrs(buf.cast(), end.cast()) };
-    // SAFETY: TODO.
+    // SAFETY: The safety preconditions require that `ptr` is a valid pointer to a `fmt::Arguments`
+    // struct.
     let _ = w.write_fmt(unsafe { *(ptr as *const fmt::Arguments<'_>) });
     w.pos().cast()
 }
@@ -104,7 +124,8 @@ pub unsafe fn call_printk(
 ) {
     // `_printk` does not seem to fail in any path.
     #[cfg(CONFIG_PRINTK)]
-    // SAFETY: TODO.
+    // SAFETY: The format string and the module name are valid to pass to `_printk` as required
+    // by the preconditions. Additionally we pass a pointer to a valid `fmt::Arguments` struct.
     unsafe {
         bindings::_printk(
             format_string.as_ptr() as _,
@@ -124,7 +145,7 @@ pub unsafe fn call_printk(
 pub fn call_printk_cont(args: fmt::Arguments<'_>) {
     // `_printk` does not seem to fail in any path.
     //
-    // SAFETY: The format string is fixed.
+    // SAFETY: The format string is fixed and we pass a valid pointer to a `fmt::Arguments`.
     #[cfg(CONFIG_PRINTK)]
     unsafe {
         bindings::_printk(
-- 
2.47.0