[PATCH] rust: list: add SAFETY comment for container_of in ListItem::view_value

[Alex Smolya]

Document the safety rationale for `container_of!` in
`ListItem::view_value` when using `ListLinksSelfPtr`.

In the `ListLinksSelfPtr` implementation of `ListItem`, the caller
guarantees that `links_field` originates from `prepare_to_insert` or
`view_links`. Both methods return a pointer to the `inner` field of
`ListLinksSelfPtr<Self, $num>` within `Self`. Therefore, calculating
the containing pointer via `container_of!` is sound and in-bounds of
the allocation.

Suggested-by: Miguel Ojeda <ojeda@xxxxxxxxxx>
Link: https://github.com/Rust-for-Linux/linux/issues/351
Signed-off-by: Alex Smolya <alexsmolya@xxxxxxxxx>
---
 rust/kernel/list/impl_list_item_mod.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/rust/kernel/list/impl_list_item_mod.rs
b/rust/kernel/list/impl_list_item_mod.rs
index c2a1f77fb..423afbf84 100644
--- a/rust/kernel/list/impl_list_item_mod.rs
+++ b/rust/kernel/list/impl_list_item_mod.rs
@@ -329,7 +329,9 @@ unsafe fn view_links(me: *const Self) -> *mut
$crate::list::ListLinks<$num> {
             //   `ListArc` containing `Self` until the next call to
`post_remove`. The value cannot
             //   be destroyed while a `ListArc` reference exists.
             unsafe fn view_value(links_field: *mut
$crate::list::ListLinks<$num>) -> *const Self {
-                // SAFETY: TODO.
+                // SAFETY: The caller promises that `links_field`
originates from
+                // `prepare_to_insert` or `view_links`, which both
return a pointer to the
+                // `inner` field of a `ListLinksSelfPtr<Self, $num>`
inside `Self`.
                 let container = unsafe {
                     $crate::container_of!(
                         links_field,
$crate::list::ListLinksSelfPtr<Self, $num>, inner
-- 
2.55.0