Re: [PATCH] rust: workqueue: replace SAFETY TODO for `WorkItemPointer` impl on `Pin<KBox<T>>`

[Sagar Taunk]

Thank you for the feedback. Are there any other things I should try to
improve in v2?


On Thu, 30 Apr 2026 at 11:29, Onur Özkan <work@xxxxxxxxxxxxx> wrote:
>
> On Thu, 30 Apr 2026 06:18:56 +0530
> Sagar Taunk <sagartaunk2@xxxxxxxxx> wrote:
>
> > The original implementation left a `SAFETY: TODO` comment on the
> > `WorkItemPointer` implementation for `Pin<KBox<T>>`. This patch documents
> > the safety requirements that make this implementation sound.
> >
> > The safety argument relies on three guarantees: `__enqueue` strips the
> > `Pin` wrapper via `Pin::into_inner_unchecked` and leaks the box via
> > `KBox::into_raw`, producing a `*mut T` whose allocation remains live for
> > the duration of the queued work; `work_container_of` safely reverses the
> > `raw_get_work` offset arithmetic to recover the exact `*mut T` that
> > `__enqueue` produced; and the workqueue guarantees `run` is called exactly
> > once, making `KBox::from_raw` sound.
> >
> > Signed-off-by: Sagar Taunk <sagartaunk2@xxxxxxxxx>
> > ---
> >  rust/kernel/workqueue.rs | 7 ++++++-
> >  1 file changed, 6 insertions(+), 1 deletion(-)
> >
> > diff --git a/rust/kernel/workqueue.rs b/rust/kernel/workqueue.rs
> > index 74c59f2b1c09..f31412fca303 100644
> > --- a/rust/kernel/workqueue.rs
> > +++ b/rust/kernel/workqueue.rs
> > @@ -881,7 +881,12 @@ unsafe impl<T, const ID: u64> RawDelayedWorkItem<ID> for Arc<T>
> >  {
> >  }
> >
> > -// SAFETY: TODO.
> > +// SAFETY: The `work_struct` pointer passed to `run` originates from `__enqueue`,
> > +// which strips the `Pin` wrapper via `Pin::into_inner_unchecked()` and leaks the box
> > +// via `KBox::into_raw()`, producing a `*mut T`. `work_container_of` then safely reverses
> > +// the `raw_get_work` offset to recover that exact `*mut T`. The workqueue itself guarantees
> > +// that `run` is called exactly once, so `KBox::from_raw()` correctly reclaims ownership
> > +// of the leaked box.
>
> Not very human readable (at least for me)... Perhaps you can check the notes
> from ARef<T> and Arc<T> impls? It They should have some parts in common like
> the initialization part.
>
> - Onur
>
> >  unsafe impl<T, const ID: u64> WorkItemPointer<ID> for Pin<KBox<T>>
> >  where
> >      T: WorkItem<ID, Pointer = Self>,
> > --
> > 2.54.0
> >