Re: [PATCH v6 3/4] rust: uaccess: add typed accessors for userspace pointers

[Alice Ryhl]

On Thu, Apr 18, 2024 at 7:27 PM Boqun Feng <boqun.feng@xxxxxxxxx> wrote:
>
> On Thu, Apr 18, 2024 at 04:23:06PM +0000, Benno Lossin wrote:
> > On 18.04.24 15:17, Alice Ryhl wrote:
> > > On Thu, Apr 18, 2024 at 3:02 PM Benno Lossin <benno.lossin@xxxxxxxxx> wrote:
> > >>
> > >> On 18.04.24 10:59, Alice Ryhl wrote:
> > >>> diff --git a/rust/kernel/types.rs b/rust/kernel/types.rs
> > >>> index 8fad61268465..9c57c6c75553 100644
> > >>> --- a/rust/kernel/types.rs
> > >>> +++ b/rust/kernel/types.rs
> > >>> @@ -409,3 +409,67 @@ pub enum Either<L, R> {
> > >>>       /// Constructs an instance of [`Either`] containing a value of type `R`.
> > >>>       Right(R),
> > >>>   }
> > >>> +
> > >>> +/// Types for which any bit pattern is valid.
> > >>> +///
> > >>> +/// Not all types are valid for all values. For example, a `bool` must be either zero or one, so
> > >>> +/// reading arbitrary bytes into something that contains a `bool` is not okay.
> > >>> +///
> > >>> +/// It's okay for the type to have padding, as initializing those bytes has no effect.
> > >>> +///
> > >>> +/// # Safety
> > >>> +///
> > >>> +/// All bit-patterns must be valid for this type. This type must not have interior mutability.
> > >>
> > >> What is the reason for disallowing interior mutability here? I agree
> > >> that it is necessary for `AsBytes`, but I don't think we need it here.
>
> Hmm.. technically, if the interior mutability behaves in a way that each
> byte is still initialized during the modification, then it should be
> fine for `AsBytes`, for example and `AtomicI32` (implemented by asm
> blocks)? Not making any change suggestion, just checking my understand.

No, that's UB. When the type is not interior mutable, then any two
loads from the same immutable reference may be assumed to return the
same value. Changing it with an atomic would violate that since the
value changes.

Alice