Re: [PATCH v3] rust: num: bounded: mark __new as unsafe

[Miguel Ojeda]

On Thu, Dec 4, 2025 at 4:39 AM Hsiu Che Yu
<yu.whisper.personal@xxxxxxxxx> wrote:
>
> The `Bounded::__new()` constructor relies on the caller to ensure the
> value can be represented within N bits. Failing to uphold this
> requirement breaks the type invariant. Mark it as unsafe and document
> this requirement in a Safety section to make the contract explicit.
>
> Update all call sites to use unsafe blocks and change their comments
> from `INVARIANT:` to `SAFETY:`, as they are now justifying unsafe
> operations rather than establishing type invariants.
>
> Fixes: 01e345e82ec3a ("rust: num: add Bounded integer wrapping type")
> Link: https://lore.kernel.org/all/aS1qC_ol2XEpZ44b@xxxxxxxxxx/
> Reported-by: Miguel Ojeda <ojeda@xxxxxxxxxx>
> Closes: https://github.com/Rust-for-Linux/linux/issues/1211
> Signed-off-by: Hsiu Che Yu <yu.whisper.personal@xxxxxxxxx>

Applied to `rust-fixes` -- thanks everyone!

We can do the cleanups I mentioned on top later, but let's get this part done.

Cheers,
Miguel