[PATCH] rust: workqueue: replace SAFETY TODO for `WorkItemPointer` impl on `Pin<KBox<T>>`

[Sagar Taunk]

The original implementation left a `SAFETY: TODO` comment on the
`WorkItemPointer` implementation for `Pin<KBox<T>>`. This patch documents
the safety requirements that make this implementation sound.

The safety argument relies on three guarantees: `__enqueue` strips the
`Pin` wrapper via `Pin::into_inner_unchecked` and leaks the box via
`KBox::into_raw`, producing a `*mut T` whose allocation remains live for
the duration of the queued work; `work_container_of` safely reverses the
`raw_get_work` offset arithmetic to recover the exact `*mut T` that
`__enqueue` produced; and the workqueue guarantees `run` is called exactly
once, making `KBox::from_raw` sound.

Signed-off-by: Sagar Taunk <sagartaunk2@xxxxxxxxx>
---
 rust/kernel/workqueue.rs | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/rust/kernel/workqueue.rs b/rust/kernel/workqueue.rs
index 74c59f2b1c09..f31412fca303 100644
--- a/rust/kernel/workqueue.rs
+++ b/rust/kernel/workqueue.rs
@@ -881,7 +881,12 @@ unsafe impl<T, const ID: u64> RawDelayedWorkItem<ID> for Arc<T>
 {
 }
 
-// SAFETY: TODO.
+// SAFETY: The `work_struct` pointer passed to `run` originates from `__enqueue`,
+// which strips the `Pin` wrapper via `Pin::into_inner_unchecked()` and leaks the box
+// via `KBox::into_raw()`, producing a `*mut T`. `work_container_of` then safely reverses
+// the `raw_get_work` offset to recover that exact `*mut T`. The workqueue itself guarantees
+// that `run` is called exactly once, so `KBox::from_raw()` correctly reclaims ownership
+// of the leaked box.
 unsafe impl<T, const ID: u64> WorkItemPointer<ID> for Pin<KBox<T>>
 where
     T: WorkItem<ID, Pointer = Self>,
-- 
2.54.0