Re: [PATCH v2 2/4] rust: bitmap: add contiguous area operations

[Eliot Courtney]

On Thu Jul 23, 2026 at 7:31 PM JST, Alice Ryhl wrote:
> On Thu, Jul 23, 2026 at 05:59:11PM +0900, Eliot Courtney wrote:
>> Add bindings for area operations on bitmaps. Each one is
>> made safe by adding some extra checks compared to the underlying C code
>> (for example, checking bounds) and with additional checks to catch
>> likely erroneous usage if `CONFIG_RUST_BITMAP_HARDENED` is on.
>> 
>> The C code uses signed integers for some parameters, for example the
>> length for `__bitmap_set`, so bounds check against i32::MAX. We can't
>> rely on `BitmapVec::MAX_LEN` because `Bitmap` may not necessarily be
>> backed by `BitmapVec`. There's also a few cases where an `align_mask`
>> can cause an infinite loop in the C code: masks that are not a power
>> of two minus one, and masks where `self.len() + align_mask` overflows
>> the alignment step, so check for those.
>> 
>> Add tests demonstrating the edge cases.
>> 
>> Signed-off-by: Eliot Courtney <ecourtney@xxxxxxxxxx>
>> ---
>>  rust/kernel/bitmap.rs | 217 ++++++++++++++++++++++++++++++++++++++++++++++++++
>>  1 file changed, 217 insertions(+)
>> 
>> diff --git a/rust/kernel/bitmap.rs b/rust/kernel/bitmap.rs
>> index a43bfe0ec3dc..1395bbe99cbb 100644
>> --- a/rust/kernel/bitmap.rs
>> +++ b/rust/kernel/bitmap.rs
>> @@ -497,6 +497,127 @@ pub fn next_zero_bit(&self, start: usize) -> Option<usize> {
>>              Some(index)
>>          }
>>      }
>> +
>> +    /// Finds a contiguous area of `nbits` zero bits at or after `start`, aligned per `align_mask`.
>> +    ///
>> +    /// Returns the bit index of the start of the area, or [`None`] if no such area fitting in
>> +    /// the bitmap exists or the `align_mask` is invalid.
>> +    ///
>> +    /// `align_mask` should be `0` (no alignment) or one less than a power of two, in which case the
>> +    /// returned index is a multiple of that power of two. Masks such that `self.len() + align_mask`
>> +    /// overflows are checked and considered invalid, as they can hang the underlying C code.
>> +    ///
>> +    /// # Panics
>> +    ///
>> +    /// Panics if CONFIG_RUST_BITMAP_HARDENED is enabled and `start` is out of bounds or
>> +    /// `align_mask` is invalid.
>> +    ///
>> +    /// # Examples
>> +    ///
>> +    /// ```
>> +    /// use kernel::alloc::{AllocError, flags::GFP_KERNEL};
>> +    /// use kernel::bitmap::BitmapVec;
>> +    ///
>> +    /// let mut b = BitmapVec::new(64, GFP_KERNEL)?;
>> +    ///
>> +    /// assert_eq!(Some(0), b.next_zero_area(0, 8, 0));
>> +    /// b.set(0, 5);
>> +    /// assert_eq!(Some(5), b.next_zero_area(0, 8, 0));
>> +    /// assert_eq!(Some(8), b.next_zero_area(0, 8, 7));
>> +    /// assert_eq!(None, b.next_zero_area(0, 65, 0));
>> +    /// # Ok::<(), AllocError>(())
>> +    /// ```
>> +    #[inline]
>> +    pub fn next_zero_area(&self, start: usize, nbits: usize, align_mask: usize) -> Option<usize> {
>
> Instead of using a `usize` argument, it'd be ideal to use the Alignment
> type defined in rust/kernel/ptr.rs, since it is guaranteed that the
> contained value is a power of two, so you can omit all those checks.
>
> (Since you need a mask, you'll need to subtract one from the provided
> Alignment, but that should be fine.)
>
> Alice

Yerp good idea thanks. I removed the checks, but there is a hang where
using Alignment doesn't help. If the length of the bitmap plus the align
mask overflows a usize, then the underlying C code can hang (depending
on the content of the bitmap). This can only happen on 32 bit systems
with a 2 GiB align and a >= 256 MiB size bitmap, so it's very rare. And
I guess it's not exactly unsafe. Happy to put the check back if people
want tho.