Re: [PATCH] rust: sync: fix safety comment for `Arc::from_raw`

[Andreas Hindborg]

"Gary Guo" <gary@xxxxxxxxxxx> writes:

> On Wed Sep 23, 2026 at 7:32 PM BST, Andreas Hindborg wrote:
>> `Arc::from_raw` does not require `T: Send`. But if `Arc::from_raw` was
>> executed on a different thread than `Arc::into_raw`, `T` must implement
>> `Send` for the API to be sound. If this is not the case, ownership of `T`
>> may be sent across a thread boundary even if `T: !Send`.
>>
>> Augment safety comment for `Arc::from_raw` to close this gap.
>>
>> Signed-off-by: Andreas Hindborg <a.hindborg@xxxxxxxxxx>
>> ---
>>  rust/kernel/sync/arc.rs | 3 +++
>>  1 file changed, 3 insertions(+)
>>
>> diff --git a/rust/kernel/sync/arc.rs b/rust/kernel/sync/arc.rs
>> index 8ae0fe6f19ec..06838ecf633c 100644
>> --- a/rust/kernel/sync/arc.rs
>> +++ b/rust/kernel/sync/arc.rs
>> @@ -276,6 +276,9 @@ pub fn as_ptr(this: &Self) -> *const T {
>>      ///
>>      /// `ptr` must have been returned by a previous call to [`Arc::into_raw`]. Additionally, it
>>      /// must not be called more than once for each previous call to [`Arc::into_raw`].
>> +    ///
>> +    /// If [`Arc::into_raw`] was executed on a different thread than the one executing
>> +    /// [`Arc::from_raw`], `T` must implement [`Send`].
>
> This needs to be `Send + Sync`?

Why does the `Arc` need to be `Sync` as well? We are transferring
ownership, not a reference.

> That said, I am not sure if we want to enumerate all cases where things can go
> wrong. For example, would `Box::from_raw` need to mention that the type is
> `Send` too? `ARef::from_raw`? `ForeignOwnable::from_foreign/borrow/borrow_mut`
> all have to mention about this, too?

I had a case where I was making unsoundness in the configfs API because
of this, but without breaking any safety requirements. I think if this
requirement had been present on `Arc`, I would have discovered the issue
while writing the safety comment for the unsafe call.

So I think it is worth it.

Best regards,
Andreas Hindborg