Re: [PATCH v4 03/22] rust: create basic untrusted data API

[Alexandre Courbot]

On Mon Sep 28, 2026 at 10:11 AM JST, alistair23 wrote:
<...>
> +/// Untrusted data of type `T`.
> +///
> +/// Data coming from userspace is considered untrusted and should be marked by this type.
> +///
> +/// The particular meaning of [`Untrusted<T>`] depends heavily on the type `T`. For example,
> +/// `&Untrusted<[u8]>` is a reference to an untrusted slice. But the length is not considered
> +/// untrusted, as it would otherwise violate normal Rust rules. For this reason, one can easily
> +/// convert that reference to `&[Untrusted<u8>]`. Another such example is `Untrusted<KVec<T>>`, it
> +/// derefs to `[Untrusted<T>]`. Raw bytes however do not behave in this way, `Untrusted<u8>` is
> +/// totally opaque.
> +///
> +/// # Usage in API Design
> +///
> +/// The exact location where to put [`Untrusted`] depends on the kind of API. When asking for an
> +/// untrusted input value, or buffer to write to, always move the [`Untrusted`] wrapper as far
> +/// inwards as possible:
> +///
> +/// ```ignore
> +/// // use this
> +/// pub fn read_from_userspace(buf: &mut [Untrusted<u8>]) { todo!() }
> +///
> +/// // and not this
> +/// pub fn read_from_userspace(buf: &mut Untrusted<[u8]>) { todo!() }
> +/// ```
> +///
> +/// The reason for this is that `&mut Untrusted<[u8]>` can beconverted into `&mut [Untrusted<u8>]`

nit: missing space: "can be converted"

> +/// very easily, but the converse is not possible.
> +///
> +/// For the same reason, when returning untrusted data by-value, one should move the [`Untrusted`]
> +/// wrapper as far outward as possible:
> +///
> +/// ```ignore
> +/// // use this
> +/// pub fn read_all_from_userspace() -> Untrusted<KVec<u8>> { todo!() }
> +///
> +/// // and not this
> +/// pub fn read_all_from_userspace() -> KVec<Untrusted<u8>> { todo!() }
> +/// ```
> +///
> +/// Here too the reason is that `KVec<Untrusted<u8>>` is more restrictive compared to
> +/// `Untrusted<KVec<u8>>`.
> +#[repr(transparent)]
> +pub struct Untrusted<T: ?Sized>(T);
> +
> +impl<T: ?Sized> Untrusted<T> {
> +    /// Marks the given value as untrusted.
> +    ///
> +    /// # Examples
> +    ///
> +    /// ```
> +    /// use kernel::validate::Untrusted;
> +    ///
> +    /// # mod bindings { pub(crate) unsafe fn read_foo_info() -> [u8; 4] { todo!() } };
> +    /// fn read_foo_info() -> Untrusted<[u8; 4]> {
> +    ///     // SAFETY: just an FFI call without preconditions.
> +    ///     Untrusted::new(unsafe { bindings::read_foo_info() })
> +    /// }
> +    /// ```
> +    #[inline]
> +    pub fn new(value: T) -> Self
> +    where
> +        T: Sized,
> +    {
> +        Self(value)
> +    }

This constructor is probably useful (although it should probably be a
`From<T>` implementation?), but is also moves `value`, which might
perform a copy on the stack that we will want to avoid if `T` is big.

So in addition to it, can we define constructors that work on references:

    pub fn from_ref(r: &T) -> &Self;
    pub fn from_mut(r: &mut T) -> &mut Self;

So we can pass around data to be validated without performing a copy.

While we are at it, we can also add slice variants:

    pub const fn from_slice(s: &[T]) -> &[Self];
    pub const fn from_mut_slice(s: &mut [T]) -> &mut [Self];

They will also be useful for the `Deref` implementations below.

> +}
> +
> +impl<T> Deref for Untrusted<[T]> {
> +    type Target = [Untrusted<T>];
> +
> +    #[inline]
> +    fn deref(&self) -> &Self::Target {
> +        // SAFETY: `Untrusted<T>` transparently wraps `T`.
> +        unsafe { cast_slice(&self.0) }

With `from_slice` above this can become:

    Untrusted::from_slice(&self.0)

> +    }
> +}
> +
> +impl<T> DerefMut for Untrusted<[T]> {
> +    #[inline]
> +    fn deref_mut(&mut self) -> &mut Self::Target {
> +        // SAFETY: `Untrusted<T>` transparently wraps `T`.
> +        unsafe { cast_slice_mut(&mut self.0) }

And this becomes:

    Untrusted::from_mut_slice(&mut self.0)

> +    }
> +}
> +
> +impl<T, A: Allocator> Deref for Untrusted<Vec<T, A>> {
> +    type Target = [Untrusted<T>];
> +
> +    #[inline]
> +    fn deref(&self) -> &Self::Target {
> +        // SAFETY: `Untrusted<T>` transparently wraps `T`.
> +        unsafe { cast_slice(self.0.as_slice()) }
> +    }
> +}
> +
> +impl<T, A: Allocator> DerefMut for Untrusted<Vec<T, A>> {
> +    #[inline]
> +    fn deref_mut(&mut self) -> &mut Self::Target {
> +        // SAFETY: `Untrusted<T>` transparently wraps `T`.
> +        unsafe { cast_slice_mut(self.0.as_mut_slice()) }
> +    }
> +}

These can also be implemented identically to the ones above.