Using `ArcInner` as `PoinedTo` in the `ForeignOwnable` implementation for
`Arc` is a bit unfortunate. Using `T` as `PointedTo` does not remove any
functionality, but allows `ArcInner` to be private. Further, it allows
downstream users to write code that is generic over `Box` and `Arc`, when
downstream users need access to `T` after calling `into_foreign`.

Reviewed-by: Fiona Behrens <me@kloenk.dev>
Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Tested-by: Daniel Almeida <daniel.almeida@collabora.com>
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
---

This patch is a dependency for Rust `configfs` abstractions. It allows both
`Box` and `Arc` to be used as pointer types in the `configfs` hierarchy.
---
 rust/kernel/sync/arc.rs | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/rust/kernel/sync/arc.rs b/rust/kernel/sync/arc.rs
index dfe4abf82c25..3d77a31e116f 100644
--- a/rust/kernel/sync/arc.rs
+++ b/rust/kernel/sync/arc.rs
@@ -143,7 +143,7 @@ pub struct Arc<T: ?Sized> {
 #[doc(hidden)]
 #[pin_data]
 #[repr(C)]
-pub struct ArcInner<T: ?Sized> {
+struct ArcInner<T: ?Sized> {
     refcount: Opaque<bindings::refcount_t>,
     data: T,
 }
@@ -345,18 +345,25 @@ pub fn into_unique_or_drop(self) -> Option<Pin<UniqueArc<T>>> {
 
 // SAFETY: The `into_foreign` function returns a pointer that is well-aligned.
 unsafe impl<T: 'static> ForeignOwnable for Arc<T> {
-    type PointedTo = ArcInner<T>;
+    type PointedTo = T;
     type Borrowed<'a> = ArcBorrow<'a, T>;
     type BorrowedMut<'a> = Self::Borrowed<'a>;
 
     fn into_foreign(self) -> *mut Self::PointedTo {
-        ManuallyDrop::new(self).ptr.as_ptr()
+        let this = ManuallyDrop::new(self).ptr.as_ptr();
+        // SAFETY: `x` is a valid pointer to `Self` so the projection below is
+        // in bounds of the allocation.
+        unsafe { core::ptr::addr_of_mut!((*this).data) }
     }
 
     unsafe fn from_foreign(ptr: *mut Self::PointedTo) -> Self {
+        // SAFETY: We did the reverse offset calculation in `into_foreign`, so
+        // the offset calculation below is in bounds of the allocation.
+        let inner_ptr = unsafe { kernel::container_of!(ptr, ArcInner<T>, data).cast_mut() };
+
         // SAFETY: The safety requirements of this function ensure that `ptr` comes from a previous
         // call to `Self::into_foreign`.
-        let inner = unsafe { NonNull::new_unchecked(ptr) };
+        let inner = unsafe { NonNull::new_unchecked(inner_ptr) };
 
         // SAFETY: By the safety requirement of this function, we know that `ptr` came from
         // a previous call to `Arc::into_foreign`, which guarantees that `ptr` is valid and
@@ -365,9 +372,13 @@ unsafe fn from_foreign(ptr: *mut Self::PointedTo) -> Self {
     }
 
     unsafe fn borrow<'a>(ptr: *mut Self::PointedTo) -> ArcBorrow<'a, T> {
+        // SAFETY: We did the reverse offset calculation in `into_foreign`, so
+        // the offset calculation below is in bounds of the allocation.
+        let inner_ptr = unsafe { kernel::container_of!(ptr, ArcInner<T>, data).cast_mut() };
+
         // SAFETY: The safety requirements of this function ensure that `ptr` comes from a previous
         // call to `Self::into_foreign`.
-        let inner = unsafe { NonNull::new_unchecked(ptr) };
+        let inner = unsafe { NonNull::new_unchecked(inner_ptr) };
 
         // SAFETY: The safety requirements of `from_foreign` ensure that the object remains alive
         // for the lifetime of the returned value.

-- 
2.47.0

On Thu, Feb 27, 2025 at 1:36 PM Andreas Hindborg <a.hindborg@kernel.org> wrote:
>
> Using `ArcInner` as `PoinedTo` in the `ForeignOwnable` implementation for
> `Arc` is a bit unfortunate. Using `T` as `PointedTo` does not remove any
> functionality, but allows `ArcInner` to be private. Further, it allows
> downstream users to write code that is generic over `Box` and `Arc`, when
> downstream users need access to `T` after calling `into_foreign`.
>
> Reviewed-by: Fiona Behrens <me@kloenk.dev>
> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
> Tested-by: Daniel Almeida <daniel.almeida@collabora.com>
> Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>

We discussed this in the meeting yesterday, but just to summarize:

This isn't correct use of the trait. The trait is intended for cases
where you pass a void pointer into C code, and the C code treats that
void pointer entirely opaquely. That's why the docs for `into_foreign`
say this:

The foreign representation is a pointer to void. There are no
guarantees for this pointer. For example, it might be invalid,
dangling or pointing to uninitialized memory. Using it in any way
except for [`from_foreign`], [`try_from_foreign`], [`borrow`], or
[`borrow_mut`] can result in undefined behavior.

In this case, you want to make this change because the C code in
configfs will dereference the void pointer and read from it. But
that's not allowed with the ForeignOwnable trait. You need a new trait
if you want pointers that are not opaque.

Alice

On Thu, Feb 27, 2025 at 7:37 AM Andreas Hindborg <a.hindborg@kernel.org> wrote:
>
> Using `ArcInner` as `PoinedTo` in the `ForeignOwnable` implementation for
> `Arc` is a bit unfortunate. Using `T` as `PointedTo` does not remove any
> functionality, but allows `ArcInner` to be private. Further, it allows
> downstream users to write code that is generic over `Box` and `Arc`, when
> downstream users need access to `T` after calling `into_foreign`.
>
> Reviewed-by: Fiona Behrens <me@kloenk.dev>
> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
> Tested-by: Daniel Almeida <daniel.almeida@collabora.com>
> Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
> ---
>
> This patch is a dependency for Rust `configfs` abstractions. It allows both
> `Box` and `Arc` to be used as pointer types in the `configfs` hierarchy.
> ---
>  rust/kernel/sync/arc.rs | 21 ++++++++++++++++-----
>  1 file changed, 16 insertions(+), 5 deletions(-)
>
> diff --git a/rust/kernel/sync/arc.rs b/rust/kernel/sync/arc.rs
> index dfe4abf82c25..3d77a31e116f 100644
> --- a/rust/kernel/sync/arc.rs
> +++ b/rust/kernel/sync/arc.rs
> @@ -143,7 +143,7 @@ pub struct Arc<T: ?Sized> {
>  #[doc(hidden)]
>  #[pin_data]
>  #[repr(C)]
> -pub struct ArcInner<T: ?Sized> {
> +struct ArcInner<T: ?Sized> {
>      refcount: Opaque<bindings::refcount_t>,
>      data: T,
>  }
> @@ -345,18 +345,25 @@ pub fn into_unique_or_drop(self) -> Option<Pin<UniqueArc<T>>> {
>
>  // SAFETY: The `into_foreign` function returns a pointer that is well-aligned.
>  unsafe impl<T: 'static> ForeignOwnable for Arc<T> {
> -    type PointedTo = ArcInner<T>;
> +    type PointedTo = T;
>      type Borrowed<'a> = ArcBorrow<'a, T>;
>      type BorrowedMut<'a> = Self::Borrowed<'a>;
>
>      fn into_foreign(self) -> *mut Self::PointedTo {
> -        ManuallyDrop::new(self).ptr.as_ptr()
> +        let this = ManuallyDrop::new(self).ptr.as_ptr();
> +        // SAFETY: `x` is a valid pointer to `Self` so the projection below is
> +        // in bounds of the allocation.

Isn't the unsafe bit `*this`, which is what this comment should
justify? In Rust 1.82+ `addr_of_mut!` isn't unsafe I believe. Also `x`
is likely meant to be `this`.

> +        unsafe { core::ptr::addr_of_mut!((*this).data) }
>      }
>
>      unsafe fn from_foreign(ptr: *mut Self::PointedTo) -> Self {
> +        // SAFETY: We did the reverse offset calculation in `into_foreign`, so
> +        // the offset calculation below is in bounds of the allocation.
> +        let inner_ptr = unsafe { kernel::container_of!(ptr, ArcInner<T>, data).cast_mut() };
> +
>          // SAFETY: The safety requirements of this function ensure that `ptr` comes from a previous
>          // call to `Self::into_foreign`.
> -        let inner = unsafe { NonNull::new_unchecked(ptr) };
> +        let inner = unsafe { NonNull::new_unchecked(inner_ptr) };
>
>          // SAFETY: By the safety requirement of this function, we know that `ptr` came from
>          // a previous call to `Arc::into_foreign`, which guarantees that `ptr` is valid and
> @@ -365,9 +372,13 @@ unsafe fn from_foreign(ptr: *mut Self::PointedTo) -> Self {
>      }
>
>      unsafe fn borrow<'a>(ptr: *mut Self::PointedTo) -> ArcBorrow<'a, T> {
> +        // SAFETY: We did the reverse offset calculation in `into_foreign`, so
> +        // the offset calculation below is in bounds of the allocation.
> +        let inner_ptr = unsafe { kernel::container_of!(ptr, ArcInner<T>, data).cast_mut() };
> +
>          // SAFETY: The safety requirements of this function ensure that `ptr` comes from a previous
>          // call to `Self::into_foreign`.
> -        let inner = unsafe { NonNull::new_unchecked(ptr) };
> +        let inner = unsafe { NonNull::new_unchecked(inner_ptr) };
>
>          // SAFETY: The safety requirements of `from_foreign` ensure that the object remains alive
>          // for the lifetime of the returned value.

It might be good to extract a shared helper from `from_foreign` and
`borrow`, though the duplication isn't new in this patch. Either way:

Reviewed-by: Tamir Duberstein <tamird@gmail.com>

"Tamir Duberstein" <tamird@gmail.com> writes:

> On Thu, Feb 27, 2025 at 7:37 AM Andreas Hindborg <a.hindborg@kernel.org> wrote:
>>
>> Using `ArcInner` as `PoinedTo` in the `ForeignOwnable` implementation for
>> `Arc` is a bit unfortunate. Using `T` as `PointedTo` does not remove any
>> functionality, but allows `ArcInner` to be private. Further, it allows
>> downstream users to write code that is generic over `Box` and `Arc`, when
>> downstream users need access to `T` after calling `into_foreign`.
>>
>> Reviewed-by: Fiona Behrens <me@kloenk.dev>
>> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
>> Tested-by: Daniel Almeida <daniel.almeida@collabora.com>
>> Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
>> ---
>>
>> This patch is a dependency for Rust `configfs` abstractions. It allows both
>> `Box` and `Arc` to be used as pointer types in the `configfs` hierarchy.
>> ---
>>  rust/kernel/sync/arc.rs | 21 ++++++++++++++++-----
>>  1 file changed, 16 insertions(+), 5 deletions(-)
>>
>> diff --git a/rust/kernel/sync/arc.rs b/rust/kernel/sync/arc.rs
>> index dfe4abf82c25..3d77a31e116f 100644
>> --- a/rust/kernel/sync/arc.rs
>> +++ b/rust/kernel/sync/arc.rs
>> @@ -143,7 +143,7 @@ pub struct Arc<T: ?Sized> {
>>  #[doc(hidden)]
>>  #[pin_data]
>>  #[repr(C)]
>> -pub struct ArcInner<T: ?Sized> {
>> +struct ArcInner<T: ?Sized> {
>>      refcount: Opaque<bindings::refcount_t>,
>>      data: T,
>>  }
>> @@ -345,18 +345,25 @@ pub fn into_unique_or_drop(self) -> Option<Pin<UniqueArc<T>>> {
>>
>>  // SAFETY: The `into_foreign` function returns a pointer that is well-aligned.
>>  unsafe impl<T: 'static> ForeignOwnable for Arc<T> {
>> -    type PointedTo = ArcInner<T>;
>> +    type PointedTo = T;
>>      type Borrowed<'a> = ArcBorrow<'a, T>;
>>      type BorrowedMut<'a> = Self::Borrowed<'a>;
>>
>>      fn into_foreign(self) -> *mut Self::PointedTo {
>> -        ManuallyDrop::new(self).ptr.as_ptr()
>> +        let this = ManuallyDrop::new(self).ptr.as_ptr();
>> +        // SAFETY: `x` is a valid pointer to `Self` so the projection below is
>> +        // in bounds of the allocation.
>
> Isn't the unsafe bit `*this`, which is what this comment should
> justify?

Yes, not sure what the origin of that name is. Good catch.

> In Rust 1.82+ `addr_of_mut!` isn't unsafe I believe. Also `x`
> is likely meant to be `this`.

The field projection (*this).data is still unsafe, as far as I know.

Actually the macro is not required any longer, the underlying raw
reference syntax has been stabilized. But since our minimum rust version
is 1.78, we have to keep the macro.

>
>> +        unsafe { core::ptr::addr_of_mut!((*this).data) }
>>      }
>>
>>      unsafe fn from_foreign(ptr: *mut Self::PointedTo) -> Self {
>> +        // SAFETY: We did the reverse offset calculation in `into_foreign`, so
>> +        // the offset calculation below is in bounds of the allocation.
>> +        let inner_ptr = unsafe { kernel::container_of!(ptr, ArcInner<T>, data).cast_mut() };
>> +
>>          // SAFETY: The safety requirements of this function ensure that `ptr` comes from a previous
>>          // call to `Self::into_foreign`.
>> -        let inner = unsafe { NonNull::new_unchecked(ptr) };
>> +        let inner = unsafe { NonNull::new_unchecked(inner_ptr) };
>>
>>          // SAFETY: By the safety requirement of this function, we know that `ptr` came from
>>          // a previous call to `Arc::into_foreign`, which guarantees that `ptr` is valid and
>> @@ -365,9 +372,13 @@ unsafe fn from_foreign(ptr: *mut Self::PointedTo) -> Self {
>>      }
>>
>>      unsafe fn borrow<'a>(ptr: *mut Self::PointedTo) -> ArcBorrow<'a, T> {
>> +        // SAFETY: We did the reverse offset calculation in `into_foreign`, so
>> +        // the offset calculation below is in bounds of the allocation.
>> +        let inner_ptr = unsafe { kernel::container_of!(ptr, ArcInner<T>, data).cast_mut() };
>> +
>>          // SAFETY: The safety requirements of this function ensure that `ptr` comes from a previous
>>          // call to `Self::into_foreign`.
>> -        let inner = unsafe { NonNull::new_unchecked(ptr) };
>> +        let inner = unsafe { NonNull::new_unchecked(inner_ptr) };
>>
>>          // SAFETY: The safety requirements of `from_foreign` ensure that the object remains alive
>>          // for the lifetime of the returned value.
>
> It might be good to extract a shared helper from `from_foreign` and
> `borrow`, though the duplication isn't new in this patch. Either way:

I would encourage a follow-up patch :)

>
> Reviewed-by: Tamir Duberstein <tamird@gmail.com>

Thanks!


Best regards,
Andreas Hindborg

Andreas Hindborg <a.hindborg@kernel.org> writes:

> "Tamir Duberstein" <tamird@gmail.com> writes:
>
>> On Thu, Feb 27, 2025 at 7:37 AM Andreas Hindborg <a.hindborg@kernel.org> wrote:
>>>
>>> Using `ArcInner` as `PoinedTo` in the `ForeignOwnable` implementation for
>>> `Arc` is a bit unfortunate. Using `T` as `PointedTo` does not remove any
>>> functionality, but allows `ArcInner` to be private. Further, it allows
>>> downstream users to write code that is generic over `Box` and `Arc`, when
>>> downstream users need access to `T` after calling `into_foreign`.
>>>
>>> Reviewed-by: Fiona Behrens <me@kloenk.dev>
>>> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
>>> Tested-by: Daniel Almeida <daniel.almeida@collabora.com>
>>> Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
>>> ---
>>>
>>> This patch is a dependency for Rust `configfs` abstractions. It allows both
>>> `Box` and `Arc` to be used as pointer types in the `configfs` hierarchy.
>>> ---
>>>  rust/kernel/sync/arc.rs | 21 ++++++++++++++++-----
>>>  1 file changed, 16 insertions(+), 5 deletions(-)
>>>
>>> diff --git a/rust/kernel/sync/arc.rs b/rust/kernel/sync/arc.rs
>>> index dfe4abf82c25..3d77a31e116f 100644
>>> --- a/rust/kernel/sync/arc.rs
>>> +++ b/rust/kernel/sync/arc.rs
>>> @@ -143,7 +143,7 @@ pub struct Arc<T: ?Sized> {
>>>  #[doc(hidden)]
>>>  #[pin_data]
>>>  #[repr(C)]
>>> -pub struct ArcInner<T: ?Sized> {
>>> +struct ArcInner<T: ?Sized> {
>>>      refcount: Opaque<bindings::refcount_t>,
>>>      data: T,
>>>  }
>>> @@ -345,18 +345,25 @@ pub fn into_unique_or_drop(self) -> Option<Pin<UniqueArc<T>>> {
>>>
>>>  // SAFETY: The `into_foreign` function returns a pointer that is well-aligned.
>>>  unsafe impl<T: 'static> ForeignOwnable for Arc<T> {
>>> -    type PointedTo = ArcInner<T>;
>>> +    type PointedTo = T;
>>>      type Borrowed<'a> = ArcBorrow<'a, T>;
>>>      type BorrowedMut<'a> = Self::Borrowed<'a>;
>>>
>>>      fn into_foreign(self) -> *mut Self::PointedTo {
>>> -        ManuallyDrop::new(self).ptr.as_ptr()
>>> +        let this = ManuallyDrop::new(self).ptr.as_ptr();
>>> +        // SAFETY: `x` is a valid pointer to `Self` so the projection below is
>>> +        // in bounds of the allocation.
>>
>> Isn't the unsafe bit `*this`, which is what this comment should
>> justify?
>
> Yes, not sure what the origin of that name is. Good catch.

Referring to the `x` part here.


Best regards,
Andreas Hindborg

On Thu, Feb 27, 2025 at 2:49 PM Tamir Duberstein <tamird@gmail.com> wrote:
>
> Isn't the unsafe bit `*this`, which is what this comment should
> justify? In Rust 1.82+ `addr_of_mut!` isn't unsafe I believe. Also `x`
> is likely meant to be `this`.

`addr_of_mut!` could also be called safely in many cases even before
1.82, i.e. it depends on the expression (and that is still true in
1.82+). The change in that version was about referring to static muts
and extern statics.

Cheers,
Miguel

On Thu, Feb 27, 2025 at 11:34 AM Miguel Ojeda
<miguel.ojeda.sandonis@gmail.com> wrote:
>
> On Thu, Feb 27, 2025 at 2:49 PM Tamir Duberstein <tamird@gmail.com> wrote:
> >
> > Isn't the unsafe bit `*this`, which is what this comment should
> > justify? In Rust 1.82+ `addr_of_mut!` isn't unsafe I believe. Also `x`
> > is likely meant to be `this`.
>
> `addr_of_mut!` could also be called safely in many cases even before
> 1.82, i.e. it depends on the expression (and that is still true in
> 1.82+). The change in that version was about referring to static muts
> and extern statics.

Thanks for explaining! Was I correct about the unsafe operation here
being the dereference?