[PATCH v2 0/7] rust: Replace unsafe core::mem::zeroed() with pin_init::zeroed()

[PATCH v2 0/7] rust: Replace unsafe core::mem::zeroed() with pin_init::zeroed()

[Ke Sun]

This patch series replaces unsafe core::mem::zeroed() calls with
pin_init::zeroed() across multiple kernel modules.

---
v2:
- Remove all the comments about zeroability

v1: https://lore.kernel.org/rust-for-linux/20260119065859.1914178-1-sunke@kylinos.cn/
- First version
---

Ke Sun (7):
  rust: auxiliary: use pin_init::zeroed() instead of unsafe zeroed
  rust: block: mq: use pin_init::zeroed() for queue_limits
  rust: block: mq: use pin_init::zeroed() for tag_set
  rust: debugfs: use pin_init::zeroed() for file_operations
  rust: of: use pin_init::zeroed() instead of unsafe zeroed
  rust: pwm: use pin_init::zeroed() for pwm_ops
  rust: security: use pin_init::zeroed() for lsm_context

 rust/kernel/auxiliary.rs         |  4 +---
 rust/kernel/block/mq/gen_disk.rs |  3 +--
 rust/kernel/block/mq/tag_set.rs  |  4 +---
 rust/kernel/debugfs/file_ops.rs  | 18 ++++++------------
 rust/kernel/of.rs                |  3 +--
 rust/kernel/pwm.rs               |  4 +---
 rust/kernel/security.rs          |  3 +--
 7 files changed, 12 insertions(+), 27 deletions(-)

-- 
2.43.0

[PATCH v2 1/7] rust: auxiliary: use pin_init::zeroed() instead of unsafe zeroed

[Ke Sun]

Replace unsafe core::mem::zeroed() with pin_init::zeroed() for
auxiliary_device_id initialization.

Signed-off-by: Ke Sun <sunke@kylinos.cn>
---
 rust/kernel/auxiliary.rs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/rust/kernel/auxiliary.rs b/rust/kernel/auxiliary.rs
index 56f3c180e8f69..d3e94a78c9340 100644
--- a/rust/kernel/auxiliary.rs
+++ b/rust/kernel/auxiliary.rs
@@ -112,9 +112,7 @@ pub const fn new(modname: &'static CStr, name: &'static CStr) -> Self {
 
         // TODO: Replace with `bindings::auxiliary_device_id::default()` once stabilized for
         // `const`.
-        //
-        // SAFETY: FFI type is valid to be zero-initialized.
-        let mut id: bindings::auxiliary_device_id = unsafe { core::mem::zeroed() };
+        let mut id: bindings::auxiliary_device_id = pin_init::zeroed();
 
         let mut i = 0;
         while i < modname.len() {
-- 
2.43.0

[PATCH v2 2/7] rust: block: mq: use pin_init::zeroed() for queue_limits

[Ke Sun]

Replace unsafe core::mem::zeroed() with pin_init::zeroed() for
queue_limits initialization.

Signed-off-by: Ke Sun <sunke@kylinos.cn>
---
 rust/kernel/block/mq/gen_disk.rs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/rust/kernel/block/mq/gen_disk.rs b/rust/kernel/block/mq/gen_disk.rs
index 1ce815c8cdab0..c8b0ecb170827 100644
--- a/rust/kernel/block/mq/gen_disk.rs
+++ b/rust/kernel/block/mq/gen_disk.rs
@@ -107,8 +107,7 @@ pub fn build<T: Operations>(
             drop(unsafe { T::QueueData::from_foreign(data) });
         });
 
-        // SAFETY: `bindings::queue_limits` contain only fields that are valid when zeroed.
-        let mut lim: bindings::queue_limits = unsafe { core::mem::zeroed() };
+        let mut lim: bindings::queue_limits = pin_init::zeroed();
 
         lim.logical_block_size = self.logical_block_size;
         lim.physical_block_size = self.physical_block_size;
-- 
2.43.0

[PATCH v2 3/7] rust: block: mq: use pin_init::zeroed() for tag_set

[Ke Sun]

Replace unsafe core::mem::zeroed() with pin_init::zeroed() for
blk_mq_tag_set initialization.

Signed-off-by: Ke Sun <sunke@kylinos.cn>
---
 rust/kernel/block/mq/tag_set.rs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/rust/kernel/block/mq/tag_set.rs b/rust/kernel/block/mq/tag_set.rs
index c3cf56d52beec..dae9df408a862 100644
--- a/rust/kernel/block/mq/tag_set.rs
+++ b/rust/kernel/block/mq/tag_set.rs
@@ -38,9 +38,7 @@ pub fn new(
         num_tags: u32,
         num_maps: u32,
     ) -> impl PinInit<Self, error::Error> {
-        // SAFETY: `blk_mq_tag_set` only contains integers and pointers, which
-        // all are allowed to be 0.
-        let tag_set: bindings::blk_mq_tag_set = unsafe { core::mem::zeroed() };
+        let tag_set: bindings::blk_mq_tag_set = pin_init::zeroed();
         let tag_set: Result<_> = core::mem::size_of::<RequestDataWrapper>()
             .try_into()
             .map(|cmd_size| {
-- 
2.43.0

[PATCH v2 4/7] rust: debugfs: use pin_init::zeroed() for file_operations

[Ke Sun]

Replace unsafe core::mem::zeroed() with pin_init::zeroed() for
file_operations initialization in all debugfs file operation
implementations.

Signed-off-by: Ke Sun <sunke@kylinos.cn>
---
 rust/kernel/debugfs/file_ops.rs | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/rust/kernel/debugfs/file_ops.rs b/rust/kernel/debugfs/file_ops.rs
index 8a0442d6dd7a4..6648e6f464b1c 100644
--- a/rust/kernel/debugfs/file_ops.rs
+++ b/rust/kernel/debugfs/file_ops.rs
@@ -126,8 +126,7 @@ impl<T: Writer + Sync> ReadFile<T> for T {
             llseek: Some(bindings::seq_lseek),
             release: Some(bindings::single_release),
             open: Some(writer_open::<Self>),
-            // SAFETY: `file_operations` supports zeroes in all fields.
-            ..unsafe { core::mem::zeroed() }
+            ..pin_init::zeroed()
         };
         // SAFETY: `operations` is all stock `seq_file` implementations except for `writer_open`.
         // `open`'s only requirement beyond what is provided to all open functions is that the
@@ -179,8 +178,7 @@ impl<T: Writer + Reader + Sync> ReadWriteFile<T> for T {
             write: Some(write::<T>),
             llseek: Some(bindings::seq_lseek),
             release: Some(bindings::single_release),
-            // SAFETY: `file_operations` supports zeroes in all fields.
-            ..unsafe { core::mem::zeroed() }
+            ..pin_init::zeroed()
         };
         // SAFETY: `operations` is all stock `seq_file` implementations except for `writer_open`
         // and `write`.
@@ -235,8 +233,7 @@ impl<T: Reader + Sync> WriteFile<T> for T {
             open: Some(write_only_open),
             write: Some(write_only_write::<T>),
             llseek: Some(bindings::noop_llseek),
-            // SAFETY: `file_operations` supports zeroes in all fields.
-            ..unsafe { core::mem::zeroed() }
+            ..pin_init::zeroed()
         };
         // SAFETY:
         // * `write_only_open` populates the file private data with the inode private data
@@ -288,8 +285,7 @@ impl<T: BinaryWriter + Sync> BinaryReadFile<T> for T {
             read: Some(blob_read::<T>),
             llseek: Some(bindings::default_llseek),
             open: Some(bindings::simple_open),
-            // SAFETY: `file_operations` supports zeroes in all fields.
-            ..unsafe { core::mem::zeroed() }
+            ..pin_init::zeroed()
         };
 
         // SAFETY:
@@ -343,8 +339,7 @@ impl<T: BinaryReader + Sync> BinaryWriteFile<T> for T {
             write: Some(blob_write::<T>),
             llseek: Some(bindings::default_llseek),
             open: Some(bindings::simple_open),
-            // SAFETY: `file_operations` supports zeroes in all fields.
-            ..unsafe { core::mem::zeroed() }
+            ..pin_init::zeroed()
         };
 
         // SAFETY:
@@ -369,8 +364,7 @@ impl<T: BinaryWriter + BinaryReader + Sync> BinaryReadWriteFile<T> for T {
             write: Some(blob_write::<T>),
             llseek: Some(bindings::default_llseek),
             open: Some(bindings::simple_open),
-            // SAFETY: `file_operations` supports zeroes in all fields.
-            ..unsafe { core::mem::zeroed() }
+            ..pin_init::zeroed()
         };
 
         // SAFETY:
-- 
2.43.0

[PATCH v2 5/7] rust: of: use pin_init::zeroed() instead of unsafe zeroed

[Ke Sun]

Replace unsafe core::mem::zeroed() with pin_init::zeroed() for
of_device_id initialization.

Signed-off-by: Ke Sun <sunke@kylinos.cn>
---
 rust/kernel/of.rs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/rust/kernel/of.rs b/rust/kernel/of.rs
index 58b20c367f993..8ae49282a09c5 100644
--- a/rust/kernel/of.rs
+++ b/rust/kernel/of.rs
@@ -36,8 +36,7 @@ impl DeviceId {
     pub const fn new(compatible: &'static CStr) -> Self {
         let src = compatible.to_bytes_with_nul();
         // Replace with `bindings::of_device_id::default()` once stabilized for `const`.
-        // SAFETY: FFI type is valid to be zero-initialized.
-        let mut of: bindings::of_device_id = unsafe { core::mem::zeroed() };
+        let mut of: bindings::of_device_id = pin_init::zeroed();
 
         // TODO: Use `copy_from_slice` once stabilized for `const`.
         let mut i = 0;
-- 
2.43.0

[PATCH v2 6/7] rust: pwm: use pin_init::zeroed() for pwm_ops

[Ke Sun]

Replace unsafe core::mem::zeroed() with pin_init::zeroed() for
pwm_ops initialization.

Signed-off-by: Ke Sun <sunke@kylinos.cn>
---
 rust/kernel/pwm.rs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/rust/kernel/pwm.rs b/rust/kernel/pwm.rs
index cb00f8a8765c8..da3ff73b6ea77 100644
--- a/rust/kernel/pwm.rs
+++ b/rust/kernel/pwm.rs
@@ -496,9 +496,7 @@ pub(crate) fn as_raw(&self) -> *const bindings::pwm_ops {
 /// This is used to bridge Rust trait implementations to the C `struct pwm_ops`
 /// expected by the kernel.
 pub const fn create_pwm_ops<T: PwmOps>() -> PwmOpsVTable {
-    // SAFETY: `core::mem::zeroed()` is unsafe. For `pwm_ops`, all fields are
-    // `Option<extern "C" fn(...)>` or data, so a zeroed pattern (None/0) is valid initially.
-    let mut ops: bindings::pwm_ops = unsafe { core::mem::zeroed() };
+    let mut ops: bindings::pwm_ops = pin_init::zeroed();
 
     ops.request = Some(Adapter::<T>::request_callback);
     ops.capture = Some(Adapter::<T>::capture_callback);
-- 
2.43.0

[PATCH v2 7/7] rust: security: use pin_init::zeroed() for lsm_context

[Ke Sun]

Replace unsafe core::mem::zeroed() with pin_init::zeroed() for
lsm_context initialization.

Signed-off-by: Ke Sun <sunke@kylinos.cn>
---
 rust/kernel/security.rs | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/rust/kernel/security.rs b/rust/kernel/security.rs
index 9d271695265fb..4dc3eba6ce84d 100644
--- a/rust/kernel/security.rs
+++ b/rust/kernel/security.rs
@@ -62,8 +62,7 @@ impl SecurityCtx {
     /// Get the security context given its id.
     #[inline]
     pub fn from_secid(secid: u32) -> Result<Self> {
-        // SAFETY: `struct lsm_context` can be initialized to all zeros.
-        let mut ctx: bindings::lsm_context = unsafe { core::mem::zeroed() };
+        let mut ctx: bindings::lsm_context = pin_init::zeroed();
 
         // SAFETY: Just a C FFI call. The pointer is valid for writes.
         to_result(unsafe { bindings::security_secid_to_secctx(secid, &mut ctx) })?;
-- 
2.43.0

Re: [PATCH v2 0/7] rust: Replace unsafe core::mem::zeroed() with pin_init::zeroed()

[Gary Guo]

On Tue Jan 20, 2026 at 8:38 AM GMT, Ke Sun wrote:
> This patch series replaces unsafe core::mem::zeroed() calls with
> pin_init::zeroed() across multiple kernel modules.
>
> ---
> v2:
> - Remove all the comments about zeroability
>
> v1: https://lore.kernel.org/rust-for-linux/20260119065859.1914178-1-sunke@kylinos.cn/
> - First version
> ---

For the series:

Reviewed-by: Gary Guo <gary@garyguo.net>

>
> Ke Sun (7):
>   rust: auxiliary: use pin_init::zeroed() instead of unsafe zeroed
>   rust: block: mq: use pin_init::zeroed() for queue_limits
>   rust: block: mq: use pin_init::zeroed() for tag_set
>   rust: debugfs: use pin_init::zeroed() for file_operations
>   rust: of: use pin_init::zeroed() instead of unsafe zeroed
>   rust: pwm: use pin_init::zeroed() for pwm_ops
>   rust: security: use pin_init::zeroed() for lsm_context
>
>  rust/kernel/auxiliary.rs         |  4 +---
>  rust/kernel/block/mq/gen_disk.rs |  3 +--
>  rust/kernel/block/mq/tag_set.rs  |  4 +---
>  rust/kernel/debugfs/file_ops.rs  | 18 ++++++------------
>  rust/kernel/of.rs                |  3 +--
>  rust/kernel/pwm.rs               |  4 +---
>  rust/kernel/security.rs          |  3 +--
>  7 files changed, 12 insertions(+), 27 deletions(-)

Re: [PATCH v2 2/7] rust: block: mq: use pin_init::zeroed() for queue_limits

[Andreas Hindborg]

"Ke Sun" <sunke@kylinos.cn> writes:

> Replace unsafe core::mem::zeroed() with pin_init::zeroed() for
> queue_limits initialization.
>
> Signed-off-by: Ke Sun <sunke@kylinos.cn>

Acked-by: Andreas Hindborg <a.hindborg@kernel.org>

Adding Jens.

Best regards,
Andreas Hindborg


> ---
>  rust/kernel/block/mq/gen_disk.rs | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/rust/kernel/block/mq/gen_disk.rs b/rust/kernel/block/mq/gen_disk.rs
> index 1ce815c8cdab0..c8b0ecb170827 100644
> --- a/rust/kernel/block/mq/gen_disk.rs
> +++ b/rust/kernel/block/mq/gen_disk.rs
> @@ -107,8 +107,7 @@ pub fn build<T: Operations>(
>              drop(unsafe { T::QueueData::from_foreign(data) });
>          });
>
> -        // SAFETY: `bindings::queue_limits` contain only fields that are valid when zeroed.
> -        let mut lim: bindings::queue_limits = unsafe { core::mem::zeroed() };
> +        let mut lim: bindings::queue_limits = pin_init::zeroed();
>
>          lim.logical_block_size = self.logical_block_size;
>          lim.physical_block_size = self.physical_block_size;
> --
> 2.43.0

Re: [PATCH v2 3/7] rust: block: mq: use pin_init::zeroed() for tag_set

[Andreas Hindborg]

"Ke Sun" <sunke@kylinos.cn> writes:

> Replace unsafe core::mem::zeroed() with pin_init::zeroed() for
> blk_mq_tag_set initialization.
>
> Signed-off-by: Ke Sun <sunke@kylinos.cn>


Acked-by: Andreas Hindborg <a.hindborg@kernel.org>

Adding Jens.

Best regards,
Andreas Hindborg


> ---
>  rust/kernel/block/mq/tag_set.rs | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/rust/kernel/block/mq/tag_set.rs b/rust/kernel/block/mq/tag_set.rs
> index c3cf56d52beec..dae9df408a862 100644
> --- a/rust/kernel/block/mq/tag_set.rs
> +++ b/rust/kernel/block/mq/tag_set.rs
> @@ -38,9 +38,7 @@ pub fn new(
>          num_tags: u32,
>          num_maps: u32,
>      ) -> impl PinInit<Self, error::Error> {
> -        // SAFETY: `blk_mq_tag_set` only contains integers and pointers, which
> -        // all are allowed to be 0.
> -        let tag_set: bindings::blk_mq_tag_set = unsafe { core::mem::zeroed() };
> +        let tag_set: bindings::blk_mq_tag_set = pin_init::zeroed();
>          let tag_set: Result<_> = core::mem::size_of::<RequestDataWrapper>()
>              .try_into()
>              .map(|cmd_size| {
> --
> 2.43.0

Re: (subset) [PATCH v2 0/7] rust: Replace unsafe core::mem::zeroed() with pin_init::zeroed()

[Jens Axboe]

On Tue, 20 Jan 2026 16:38:16 +0800, Ke Sun wrote:
> This patch series replaces unsafe core::mem::zeroed() calls with
> pin_init::zeroed() across multiple kernel modules.
> 

Applied, thanks!

[2/7] rust: block: mq: use pin_init::zeroed() for queue_limits
      commit: d7a4693a250ee2f185ce5c878e74252e533ac4b9
[3/7] rust: block: mq: use pin_init::zeroed() for tag_set
      commit: 880528eaa67fc6446a0b5c16757f0d6a2639ccda

Best regards,
-- 
Jens Axboe

Re: [PATCH v2 0/7] rust: Replace unsafe core::mem::zeroed() with pin_init::zeroed()

[Miguel Ojeda]

On Tue, Jan 20, 2026 at 9:38 AM Ke Sun <sunke@kylinos.cn> wrote:
>
> This patch series replaces unsafe core::mem::zeroed() calls with
> pin_init::zeroed() across multiple kernel modules.

A few of these were already sent by (by Atharv and Moritz, Cc'd):

https://lore.kernel.org/rust-for-linux/20251129124706.26263-1-atharvd440@gmail.com/
https://lore.kernel.org/rust-for-linux/20251129135657.36144-1-atharvd440@gmail.com/
https://lore.kernel.org/rust-for-linux/20251030-zeroed-of-rs-v1-1-1c46d025128e@gmail.com/

In addition, they were also sent by Benno, and in the issue he
mentions "re-sending", which usually means just adding your
Signed-off-by below his. Otherwise, if he is OK without authorship,
this should most likely have:

Suggested-by: Benno Lossin <lossin@kernel.org>
Link: https://github.com/Rust-for-Linux/linux/issues/1189

Cheers,
Miguel

Re: [PATCH v2 4/7] rust: debugfs: use pin_init::zeroed() for file_operations

[Danilo Krummrich]

On Tue Jan 20, 2026 at 9:38 AM CET, Ke Sun wrote:
> Replace unsafe core::mem::zeroed() with pin_init::zeroed() for
> file_operations initialization in all debugfs file operation
> implementations.
>
> Signed-off-by: Ke Sun <sunke@kylinos.cn>

Applied to driver-core-testing, thanks!

Re: [PATCH v2 0/7] rust: Replace unsafe core::mem::zeroed() with pin_init::zeroed()

[Ke Sun]

Hi Miguel,

Thanks for pointing this out! I wasn't aware others had already submitted
patches for this. I'm fine with any arrangement, and I'll check GitHub 
issues
more carefully going forward.

Best regards,
Ke Sun

On 1/26/26 03:24, Miguel Ojeda wrote:
> On Tue, Jan 20, 2026 at 9:38 AM Ke Sun <sunke@kylinos.cn> wrote:
>> This patch series replaces unsafe core::mem::zeroed() calls with
>> pin_init::zeroed() across multiple kernel modules.
> A few of these were already sent by (by Atharv and Moritz, Cc'd):
>
> https://lore.kernel.org/rust-for-linux/20251129124706.26263-1-atharvd440@gmail.com/
> https://lore.kernel.org/rust-for-linux/20251129135657.36144-1-atharvd440@gmail.com/
> https://lore.kernel.org/rust-for-linux/20251030-zeroed-of-rs-v1-1-1c46d025128e@gmail.com/
>
> In addition, they were also sent by Benno, and in the issue he
> mentions "re-sending", which usually means just adding your
> Signed-off-by below his. Otherwise, if he is OK without authorship,
> this should most likely have:
>
> Suggested-by: Benno Lossin <lossin@kernel.org>
> Link: https://github.com/Rust-for-Linux/linux/issues/1189
>
> Cheers,
> Miguel
>

Re: [PATCH v2 0/7] rust: Replace unsafe core::mem::zeroed() with pin_init::zeroed()

[Miguel Ojeda]

On Tue, Jan 27, 2026 at 6:56 AM Ke Sun <sunke@kylinos.cn> wrote:
>
> Thanks for pointing this out! I wasn't aware others had already submitted
> patches for this. I'm fine with any arrangement, and I'll check GitHub
> issues
> more carefully going forward.

No worries at all, it happens :)

Just a quick note in case it helps: searching lore.kernel.org for
previous/ongoing work is even more important, since the vast majority
of patches do not have associated GitHub issues (they may be in other
subsystem's trackers or in none at all).

Cheers,
Miguel