Re: [PATCH 2/3] rust: convert `Arc` to use `Refcount`

[Alice Ryhl]

On Fri, Oct 4, 2024 at 5:53 PM Gary Guo <gary@xxxxxxxxxxx> wrote:
>
> With `Refcount` type created, `Arc` can use `Refcount` instead of
> calling into FFI directly.
>
> Cc: Will Deacon <will@xxxxxxxxxx>
> Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
> Cc: Boqun Feng <boqun.feng@xxxxxxxxx>
> Cc: Mark Rutland <mark.rutland@xxxxxxx>
> Signed-off-by: Gary Guo <gary@xxxxxxxxxxx>

[...]

> -            // SAFETY: We have exclusive access to the arc, so we can perform unsynchronized
> -            // accesses to the refcount.
> -            unsafe { core::ptr::write(refcount, bindings::REFCOUNT_INIT(1)) };
> +            // We have exclusive access to the arc, so we can modify the refcount at will.
> +            refcount.set(1);

Why are you changing this to an atomic write? We just took ownership,
so we have exclusive access and can perform an unsynchronized write.

>  impl<T: ?Sized> Drop for Arc<T> {
>      fn drop(&mut self) {
> -        // SAFETY: By the type invariant, there is necessarily a reference to the object. We cannot
> -        // touch `refcount` after it's decremented to a non-zero value because another thread/CPU
> -        // may concurrently decrement it to zero and free it. It is ok to have a raw pointer to
> -        // freed/invalid memory as long as it is never dereferenced.
> -        let refcount = unsafe { self.ptr.as_ref() }.refcount.get();
> -
>          // INVARIANT: If the refcount reaches zero, there are no other instances of `Arc`, and
>          // this instance is being dropped, so the broken invariant is not observable.
> -        // SAFETY: Also by the type invariant, we are allowed to decrement the refcount.
> -        let is_zero = unsafe { bindings::refcount_dec_and_test(refcount) };
> +        // SAFETY: By the type invariant, there is necessarily a reference to the object.
> +        // NOTE: we cannot touch `refcount` after it's decremented to a non-zero value because
> +        // another thread/CPU may concurrently decrement it to zero and free it. However it is okay
> +        // to have a transient reference to decrement the refcount, see
> +        // https://github.com/rust-lang/rust/issues/55005.
> +        let is_zero = unsafe { self.ptr.as_ref().refcount.dec_and_test() };

This code needs to make use of this guarantee for correctness:

For both `&T` without `UnsafeCell<_>` and `&mut T`, you must also not
deallocate the data until the reference expires. As a special
exception, given an `&T`, any part of it that is inside an
`UnsafeCell<_>` may be deallocated during the lifetime of the
reference, after the last time the reference is used (dereferenced or
reborrowed). Since you cannot deallocate a part of what a reference
points to, this means the memory an `&T` points to can be deallocated
only if *every part of it* (including padding) is inside an
`UnsafeCell`.

from https://doc.rust-lang.org/stable/std/cell/struct.UnsafeCell.html

so when invoking `dec_and_test()` you can have a reference to the
`Refcount`, but not necessarily to other parts of `ArcInner` like you
do here.

Alice