Re: [PATCH v4] rust: list: Add unsafe for container_of

[Miguel Ojeda]

On Mon, Feb 16, 2026 at 2:17 PM Philipp Stanner <phasta@xxxxxxxxxx> wrote:
>
> impl_list_item_mod.rs calls container_of() without unsafe blocks at a
> couple of places. Since container_of() is an unsafe macro / function,
> the blocks are strictly necessary.
>
> The problem was so far not visible because the "unsafe-op-in-unsafe-fn"
> check is a linter rather than a compiler check. Rust suppresses lint
> checks triggered inside of a macro from another crate. Thus, the error
> becomes only visible once someone from without the core crate tries to
> use linked lists:
>
> error[E0133]: call to unsafe function `core::ptr::mut_ptr::<impl *mut T>::byte_sub`
> is unsafe and requires unsafe block
>    --> rust/kernel/lib.rs:252:29
>     |
> 252 |           let container_ptr = field_ptr.byte_sub(offset).cast::<$Container>();
>     |                               ^^^^^^^^^^^^^^^^^^^^^^^^^^ call to unsafe function
>     |
>    ::: rust/kernel/drm/jq.rs:98:1
>     |
> 98  | / impl_list_item! {
> 99  | |     impl ListItem<0> for BasicItem { using ListLinks { self.links }; }
> 100 | | }
>     | |_- in this macro invocation
>     |
> note: an unsafe function restricts its caller, but its body is safe by default
>    --> rust/kernel/list/impl_list_item_mod.rs:216:13
>     |
> 216 |               unsafe fn view_value(me: *mut $crate::list::ListLinks<$num>) -> *const Self {
>     |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>     |
>    ::: rust/kernel/drm/jq.rs:98:1
>     |
> 98  | / impl_list_item! {
> 99  | |     impl ListItem<0> for BasicItem { using ListLinks { self.links }; }
> 100 | | }
>     | |_- in this macro invocation
>     = note: requested on the command line with `-D unsafe-op-in-unsafe-fn`
>     = note: this error originates in the macro `$crate::container_of` which comes
>     from the expansion of the macro `impl_list_item`
>
> Add unsafe blocks to container_of to fix the issue.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: c77f85b347dd ("rust: list: remove OFFSET constants")
> Suggested-by: Alice Ryhl <aliceryhl@xxxxxxxxxx>
> Signed-off-by: Philipp Stanner <phasta@xxxxxxxxxx>
> Reviewed-by: Gary Guo <gary@xxxxxxxxxxx>
> Reviewed-by: Alice Ryhl <aliceryhl@xxxxxxxxxx>

(I said it was applied, but for completeness, let me send my usual
message here... The commit is in mainline already.).

Applied to `rust-fixes` -- thanks everyone!

    [ As discussed, let's fix the build for those that want to use the
      macro within the `kernel` crate now and we can discuss the proper
      safety comments afterwards. Thus I removed the ones from the patch.

      However, we cannot just avoid the comments with `CLIPPY=1`, so I
      provided placeholders for now, like we did in the past. They were
      also needed for an `unsafe impl`.

      While I am not happy about it, it isn't worse than the current
      status (the comments were meant to be there), and at least this
      shows what is missing -- our pre-existing "good first issue" [1]
      may motivate new contributors to complete them properly.

      Finally, I moved one of the existing safety comments one line down
      so that Clippy could locate it.

      Link: https://github.com/Rust-for-Linux/linux/issues/351 [1]

        - Miguel ]

    [ Fixed formatting. Reworded to fix the lint suppression
      explanation. Indent build error. - Miguel ]

Cheers,
Miguel