Re: [RFC 03/16] rust/alloc: add Vec::into_boxed_slice()

["Danilo Krummrich" <dakr@kernel.org>]

On Tue Mar 31, 2026 at 9:02 PM CEST, David Rheinsberg wrote:
> Add `Vec::into_boxed_slice()` similar to
> `std::vec::Vec::into_boxed_slice()` [1].
>
> There is currently no way to easily consume the allocation of a vector.
> However, it is very convenient to use `Vec` to initialize a dynamically
> sized array and then "seal" it, so it can be passed along as a Box:
>
>     fn create_from(src: &[T]) -> Result<KBox<[U]>, AllocError> {
>         let v = Vec::with_capacity(n, GFP_KERNEL)?;
>
>         for i in src {
>             v.push(foo(i)?, GFP_KERNEL)?;
>         }
>
>         Ok(v.into_boxed_slice())
>     }
>
> A valid alternative is to use `Box::new_uninit()` rather than
> `Vec::with_capacity()`, and eventually convert the box via
> `Box::assume_init()`. This works but needlessly requires unsafe code,
> awkward drop handling, etc. Using `Vec` is the much simpler solution.
>
> [1] https://doc.rust-lang.org/std/vec/struct.Vec.html#method.into_boxed_slice
>
> Signed-off-by: David Rheinsberg <david@readahead.eu>

Thanks for presenting a user! Please make sure to use scripts/get_maintainer.pl.

Also, this patch has already been posted in [1], so it should be mentioned that
this is a v2 and it should include a changelog.

> ---
>  rust/kernel/alloc/kvec.rs | 67 +++++++++++++++++++++++++++++++++++++++
>  1 file changed, 67 insertions(+)
>
> diff --git a/rust/kernel/alloc/kvec.rs b/rust/kernel/alloc/kvec.rs
> index ac8d6f763ae8..b8b0fa1a7505 100644
> --- a/rust/kernel/alloc/kvec.rs
> +++ b/rust/kernel/alloc/kvec.rs
> @@ -733,6 +733,73 @@ pub fn retain(&mut self, mut f: impl FnMut(&mut T) -> bool) {
>          }
>          self.truncate(num_kept);
>      }
> +
> +    fn shrink_to_fit(&mut self) -> Result<(), AllocError>  {
> +        if Self::is_zst() {
> +            // ZSTs always use maximum capacity.
> +            return Ok(());
> +        }
> +
> +        let layout = ArrayLayout::new(self.len()).map_err(|_| AllocError)?;
> +
> +        // SAFETY:
> +        // - `ptr` is valid because it's either `None` or comes from a previous
> +        //   call to `A::realloc`.
> +        // - `self.layout` matches the `ArrayLayout` of the preceding
> +        //   allocation.
> +        let ptr = unsafe {
> +            A::realloc(
> +                Some(self.ptr.cast()),
> +                layout.into(),
> +                self.layout.into(),
> +                crate::alloc::flags::GFP_NOWAIT,

Why? This should be specified by the caller. Besides, I don't see how this could
ever end up in memory reclaim in the first place.

> +                NumaNode::NO_NODE,
> +            )?
> +        };
> +
> +        // INVARIANT:
> +        // - `layout` is some `ArrayLayout::<T>`,
> +        // - `ptr` has been created by `A::realloc` from `layout`.
> +        self.ptr = ptr.cast();
> +        self.layout = layout;
> +        Ok(())
> +    }
> +
> +    /// Converts the vector into [`Box<[T], A>`].
> +    ///
> +    /// Excess capacity is retained in the allocation, but lost until the box
> +    /// is dropped.
> +    ///
> +    /// This function is fallible, because kernel allocators do not guarantee
> +    /// that shrinking reallocations are infallible, yet the Rust abstractions
> +    /// strictly require that layouts are correct. Hence, the caller must be
> +    /// ready to deal with reallocation failures.
> +    ///
> +    /// # Examples
> +    ///
> +    /// ```
> +    /// let mut v = KVec::<u16>::with_capacity(4, GFP_KERNEL)?;
> +    /// for i in 0..4 {
> +    ///     v.push(i, GFP_KERNEL);
> +    /// }
> +    /// let s: KBox<[u16]> = v.into_boxed_slice()?;
> +    /// assert_eq!(s.len(), 4);
> +    /// # Ok::<(), kernel::alloc::AllocError>(())
> +    /// ```
> +    pub fn into_boxed_slice(mut self) -> Result<Box<[T], A>, AllocError> {
> +        self.shrink_to_fit()?;

As mentioned in [1], I think into_boxed_slice() should call A::realloc()
directly; at least use a separate internal helper. shrink_to_fit() will
eventually be exposed to users and the actual semantics is yet to be defined.
I.e. it may have additional logic.

The requirement here is not to actually shrink the backing memory, but to
satisfy the safety requirement of A::free(). And the best way to ensure this is
to call A::realloc() with ArrayLayout::new(self.len()).

IOW, please don't call the above method shrink_to_fit(), but maybe
realloc_to_fit(). If shrink_to_fit() will just end up calling realloc_to_fit()
that's fine.

> +        let (buf, len, _cap) = self.into_raw_parts();
> +        let slice = ptr::slice_from_raw_parts_mut(buf, len);
> +
> +        // SAFETY:
> +        // - `slice` has been allocated with `A`
> +        // - `slice` is suitably aligned
> +        // - `slice` has an exact length of `len`
> +        // - all elements within `slice` are initialized values of `T`
> +        // - `len` does not exceed `isize::MAX`
> +        // - `slice` was allocated for `Layout::for_value::<[T]>()`

Thanks for adding this! Mind also sending a fix for Box::from_raw() which lacks
the safety requirement?

> +        Ok(unsafe { Box::from_raw(slice) })
> +    }
>  }

[1] https://lore.kernel.org/all/20260326095621.846840-1-david@readahead.eu/