[PATCH] rust: print: document safety of formatting calls

[PATCH] rust: print: document safety of formatting calls

[Yilin Chen]

Replace the remaining "// SAFETY: TODO." comments in the Rust printing
implementation with explanations.

The `call_printk` function passes a module name for %s and a pointer to
fmt::Arguments for %pA. Restrict its safety contract to
non-continuation format strings, since the continuation format contains
only %pA and uses a different argument layout.

Assisted-by: Gpt-5.6 Sol
Signed-off-by: Yilin Chen <1479826151@qq.com>
---
 rust/kernel/print.rs | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/rust/kernel/print.rs b/rust/kernel/print.rs
index 0d62beeedca5..86b4347a7707 100644
--- a/rust/kernel/print.rs
+++ b/rust/kernel/print.rs
@@ -29,7 +29,8 @@
     use fmt::Write;
     // SAFETY: The C contract guarantees that `buf` is valid if it's less than `end`.
     let mut w = unsafe { RawFormatter::from_ptrs(buf.cast(), end.cast()) };
-    // SAFETY: TODO.
+    // SAFETY: `%pA` is a Rust-only format specifier. Its callers pass `ptr` as
+    // a valid pointer to a `fmt::Arguments<'_>` value.
     let _ = w.write_fmt(unsafe { *ptr.cast::<fmt::Arguments<'_>>() });
     w.pos().cast()
 }
@@ -96,8 +97,8 @@ pub mod format_strings {
 ///
 /// # Safety
 ///
-/// The format string must be one of the ones in [`format_strings`], and
-/// the module name must be null-terminated.
+/// The format string must be one of the non-continuation strings in
+/// [`format_strings`], and the module name must be null-terminated.
 ///
 /// [`_printk`]: srctree/include/linux/printk.h
 #[doc(hidden)]
@@ -109,7 +110,10 @@ pub unsafe fn call_printk(
 ) {
     // `_printk` does not seem to fail in any path.
     #[cfg(CONFIG_PRINTK)]
-    // SAFETY: TODO.
+    // SAFETY: `format_string` is one of the non-continuation strings in `format_strings`,
+    // so its `%s` and `%pA` specifiers match `module_name` and `args`, respectively.
+    // `module_name` is NUL-terminated as required by this function's safety
+    // contract.
     unsafe {
         bindings::_printk(
             format_string.as_ptr(),
-- 
2.25.1