Re: [PATCH v7 2/7] rust: uaccess: add write_dma() for copying from DMA buffers to userspace

["Danilo Krummrich" <dakr@kernel.org>]

On Tue Feb 3, 2026 at 11:47 PM CET, Timur Tabi wrote:
> Add UserSliceWriter::write_dma() to copy data from a CoherentAllocation<u8>
> to userspace. This provides a safe interface for copying DMA buffer
> contents to userspace without requiring callers to work with raw pointers.
>
> Because write_dma() and write_slice() have common code, factor that code
> out into a helper function, write_raw().
>
> The method handles bounds checking and offset calculation internally,
> wrapping the unsafe copy_to_user() call.
>
> Signed-off-by: Timur Tabi <ttabi@nvidia.com>
> ---
>  rust/kernel/uaccess.rs | 74 +++++++++++++++++++++++++++++++++++-------
>  1 file changed, 63 insertions(+), 11 deletions(-)
>
> diff --git a/rust/kernel/uaccess.rs b/rust/kernel/uaccess.rs
> index f989539a31b4..d29a52f2a878 100644
> --- a/rust/kernel/uaccess.rs
> +++ b/rust/kernel/uaccess.rs
> @@ -7,6 +7,7 @@
>  use crate::{
>      alloc::{Allocator, Flags},
>      bindings,
> +    dma::CoherentAllocation,
>      error::Result,
>      ffi::{c_char, c_void},
>      fs::file,
> @@ -459,20 +460,20 @@ pub fn is_empty(&self) -> bool {
>          self.length == 0
>      }
>  
> -    /// Writes raw data to this user pointer from a kernel buffer.
> -    ///
> -    /// Fails with [`EFAULT`] if the write happens on a bad address, or if the write goes out of
> -    /// bounds of this [`UserSliceWriter`]. This call may modify the associated userspace slice even
> -    /// if it returns an error.
> -    pub fn write_slice(&mut self, data: &[u8]) -> Result {
> -        let len = data.len();
> -        let data_ptr = data.as_ptr().cast::<c_void>();
> +    /// Low-level write from a raw pointer. Caller must ensure ptr is valid for `len` bytes.
> +    fn write_raw(&mut self, ptr: *const u8, len: usize) -> Result {

The method has to be unsafe as the caller has to promise that ptr is indeed a
slice with len elements.

Another option would be to pass a fat pointer, i.e. *const [u8]. write_dma()
would then need to use ptr::slice_from_raw_parts() and the safety requirement of
this function becomes that ptr simply has to be valid.