mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-12-28 16:56:26 +00:00
ce1c54fdff
Refactor the `FromBytes` and `AsBytes` traits from `types.rs` into a new `transmute.rs` module: - Add `rust/kernel/transmute.rs` with the definitions of `FromBytes` and `AsBytes`. - Remove the same trait definitions from `rust/kernel/types.rs`. - Update `rust/kernel/uaccess.rs` to import `AsBytes` and `FromBytes` from `transmute.rs`. The traits and their implementations remain unchanged. Suggested-by: Benno Lossin <benno.lossin@proton.me> Link: https://github.com/Rust-for-Linux/linux/issues/1117 Signed-off-by: Aliet Exposito Garcia <aliet.exposito@gmail.com> Reviewed-by: Fiona Behrens <me@kloenk.dev> Reviewed-by: Benno Lossin <benno.lossin@proton.me> Link: https://lore.kernel.org/r/20240918225115.2309224-2-aliet.exposito@gmail.com [ Rebased on top of the lints series and slightly reworded. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
72 lines
2.5 KiB
Rust
72 lines
2.5 KiB
Rust
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
//! Traits for transmuting types.
|
|
|
|
/// Types for which any bit pattern is valid.
|
|
///
|
|
/// Not all types are valid for all values. For example, a `bool` must be either zero or one, so
|
|
/// reading arbitrary bytes into something that contains a `bool` is not okay.
|
|
///
|
|
/// It's okay for the type to have padding, as initializing those bytes has no effect.
|
|
///
|
|
/// # Safety
|
|
///
|
|
/// All bit-patterns must be valid for this type. This type must not have interior mutability.
|
|
pub unsafe trait FromBytes {}
|
|
|
|
macro_rules! impl_frombytes {
|
|
($($({$($generics:tt)*})? $t:ty, )*) => {
|
|
// SAFETY: Safety comments written in the macro invocation.
|
|
$(unsafe impl$($($generics)*)? FromBytes for $t {})*
|
|
};
|
|
}
|
|
|
|
impl_frombytes! {
|
|
// SAFETY: All bit patterns are acceptable values of the types below.
|
|
u8, u16, u32, u64, usize,
|
|
i8, i16, i32, i64, isize,
|
|
|
|
// SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
|
|
// patterns are also acceptable for arrays of that type.
|
|
{<T: FromBytes>} [T],
|
|
{<T: FromBytes, const N: usize>} [T; N],
|
|
}
|
|
|
|
/// Types that can be viewed as an immutable slice of initialized bytes.
|
|
///
|
|
/// If a struct implements this trait, then it is okay to copy it byte-for-byte to userspace. This
|
|
/// means that it should not have any padding, as padding bytes are uninitialized. Reading
|
|
/// uninitialized memory is not just undefined behavior, it may even lead to leaking sensitive
|
|
/// information on the stack to userspace.
|
|
///
|
|
/// The struct should also not hold kernel pointers, as kernel pointer addresses are also considered
|
|
/// sensitive. However, leaking kernel pointers is not considered undefined behavior by Rust, so
|
|
/// this is a correctness requirement, but not a safety requirement.
|
|
///
|
|
/// # Safety
|
|
///
|
|
/// Values of this type may not contain any uninitialized bytes. This type must not have interior
|
|
/// mutability.
|
|
pub unsafe trait AsBytes {}
|
|
|
|
macro_rules! impl_asbytes {
|
|
($($({$($generics:tt)*})? $t:ty, )*) => {
|
|
// SAFETY: Safety comments written in the macro invocation.
|
|
$(unsafe impl$($($generics)*)? AsBytes for $t {})*
|
|
};
|
|
}
|
|
|
|
impl_asbytes! {
|
|
// SAFETY: Instances of the following types have no uninitialized portions.
|
|
u8, u16, u32, u64, usize,
|
|
i8, i16, i32, i64, isize,
|
|
bool,
|
|
char,
|
|
str,
|
|
|
|
// SAFETY: If individual values in an array have no uninitialized portions, then the array
|
|
// itself does not have any uninitialized portions either.
|
|
{<T: AsBytes>} [T],
|
|
{<T: AsBytes, const N: usize>} [T; N],
|
|
}
|