Re: [PATCH 1/2] rust: list: fix SAFETY comment in List::remove

["Gary Guo" <gary@garyguo.net>]

On Tue Apr 28, 2026 at 8:27 AM BST, Alice Ryhl wrote:
> On Tue, Apr 07, 2026 at 12:56:52PM +0100, Gary Guo wrote:
>> On Tue Apr 7, 2026 at 9:15 AM BST, Alice Ryhl wrote:
>> > On Fri, Apr 03, 2026 at 10:08:15PM +0000, Christian Benton wrote:
>> >> The SAFETY comment for the call to ListLinks::fields in List::remove
>> >> was left as TODO. Fill it in: the call is safe because T::view_links
>> >> returns a reference to the ListLinks field of item, and references are
>> >> always valid and non-dangling.
>> >> 
>> >> Signed-off-by: Christian Benton <t1bur0n.kernel.org@protonmail.ch>
>> >
>> > Thanks. I agree that `item` being a reference is the only thing needed
>> > for this to be sound, as reference implies that the pointer is not
>> > dangling.
>> 
>> (cc Philipp)
>> 
>> FWIW, I want to change `item` from a reference to a raw pointer. In Philipp's
>> WIP DRM job scheduler implementation, there is a case where the list is
>> conceptually a list of `UniqueArc`s; each job only needs to handle that is
>> sufficient to locate the item in the list and remove it.
>> 
>> I suggested to him that keeping a pointer and do a list iter with ptr
>> comparison is sufficient to achieve that without needing to do additional
>> reference counting. Of course I don't want to iterate the list when I could just
>> call `remove` function on the list itself; for that use case I want to change
>> the `remove` function to only require a pointer (with additional safety
>> requirement that it is valid).
>> 
>> It's orthogonal to this change as I'll probably be more careful about pointer
>> provenance too when making that change, so just a heads up.
>
> Could you explain why? Is there any scenario where the caller couldn't
> just create a reference to the value from their raw pointer?
>
> Alice

We currently have something like this:

    // Insert
    let handle = &raw const *unique_arc;
    list.push_back(unique_arc.into());

    // Remove
    let unique_arc = list.remove(handle).into_unique_or_drop().unwrap();

I.e. the list is conceptually list of `UniqueArc`. (I hope it can eventually be
just represented that way use type system, or even just use boxes).

I suppose we could do

    // Insert
    let list_arc: ListArc<_> = unique_arc.into();
    let ptr = list_arc.as_arc().as_ptr();
    list.push_back(list_arc);

    // Remove
    let unique_arc = list.remove(&*ptr).into_unique_or_drop().unwrap();

but this make me feel uncomfortable w.r.t aliasing, even though I think it's
fine with the list code we have today.

Best,
Gary