From nobody Mon Feb 9 15:09:28 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 573B1223DED for ; Thu, 1 May 2025 18:37:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746124672; cv=none; b=hLGbfj7YD+qfGw3gfh4NwL9fyJO9FqTLZSwi42yXX74pvr5D8Qjn9JdKFF6h2DouPirYvAJEICqqS9N30j1O/mX6KkQmoi5H5LGql/yepVwpleBl+5ioe7CAJ1HDaMStgl/YNYECcDUp67t7WWBbLdQRa/4myuzjjqj1+eaBuTE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746124672; c=relaxed/simple; bh=SrzFAyg30d6oGKEyLW8zbG9Y5AMJTECOWzAs9Z0xqlQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kNLc+ar/Kdz0zt5tg+WRKa6JtVY16nNCD54URklUXOzdCc2/cF7fmWs/N3/KIPAhv4Yx+dMtMPXMQh33opygo85+usen59v795hQwa7x9h6akF6ferD9puL62NMsXJmyY36trvl98Diba5fpPUaerpZx8A47P5RXMEQ2JTwVZH4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=JFYajEIl; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="JFYajEIl" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1746124668; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GRNBnPmAgdVGuEdAa7ItVzU96gbWj7IMk8GXzUCuJj8=; b=JFYajEIlcQeoe10bwaukanJMNFVxWCJ6pF5XdmCzjNd1Qem9GFDv3WhEcDBLKRNFDY0jUn Dq9XP8wDnvF0s1V53yBz/t/fW5uAPs0i74CJd1Z9QzTDc1TZLpt3hBmP/NSG9IwvzRUzLC jvLwQfjyz4iaIO7x5koje3DqYZx64m0= Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-18-gnVgooa7MYmArRUfhUZFwg-1; Thu, 01 May 2025 14:37:45 -0400 X-MC-Unique: gnVgooa7MYmArRUfhUZFwg-1 X-Mimecast-MFC-AGG-ID: gnVgooa7MYmArRUfhUZFwg_1746124662 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D64771801A0F; Thu, 1 May 2025 18:37:41 +0000 (UTC) Received: from chopper.redhat.com (unknown [10.22.88.132]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 033881800115; Thu, 1 May 2025 18:37:37 +0000 (UTC) From: Lyude Paul To: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org Cc: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Miguel Ojeda , Alex Gaynor , Boqun Feng , Gary Guo , =?UTF-8?q?Bj=C3=B6rn=20Roy=20Baron?= , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich , Asahi Lina , Alyssa Rosenzweig Subject: [PATCH 2/4] rust: drm: gem: Refactor IntoGEMObject::from_gem_obj() to as_ref() Date: Thu, 1 May 2025 14:33:17 -0400 Message-ID: <20250501183717.2058109-3-lyude@redhat.com> In-Reply-To: <20250501183717.2058109-1-lyude@redhat.com> References: <20250501183717.2058109-1-lyude@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Content-Type: text/plain; charset="utf-8" There's a few issues with this function, mainly: * This function -probably- should have been unsafe from the start. Pointers are not always necessarily valid, but you want a function that does field-projection for a pointer that can travel outside of the original struct to be unsafe, at least if I understand properly. * *mut Self is not terribly useful in this context, the majority of uses of from_gem_obj() grab a *mut Self and then immediately convert it into a &'a Self. It also goes against the ffi conventions we've set in the rest of the kernel thus far. * from_gem_obj() also doesn't follow the naming conventions in the rest of the DRM bindings at the moment, as_ref() would be a better name. So, let's: * Make from_gem_obj() unsafe * Convert it to return &'a Self * Rename it to as_ref() * Update all call locations Signed-off-by: Lyude Paul Reviewed-by: Daniel Almeida --- rust/kernel/drm/gem/mod.rs | 67 ++++++++++++++++++++++++-------------- 1 file changed, 42 insertions(+), 25 deletions(-) diff --git a/rust/kernel/drm/gem/mod.rs b/rust/kernel/drm/gem/mod.rs index df8f9fdae5c22..f70531889c21f 100644 --- a/rust/kernel/drm/gem/mod.rs +++ b/rust/kernel/drm/gem/mod.rs @@ -45,8 +45,12 @@ pub trait IntoGEMObject: Sized + super::private::Sealed { #[allow(clippy::wrong_self_convention)] fn into_gem_obj(&self) -> &Opaque; =20 - /// Converts a pointer to a `struct drm_gem_object` into a pointer to = `Self`. - fn from_gem_obj(obj: *mut bindings::drm_gem_object) -> *mut Self; + /// Converts a pointer to a `struct drm_gem_object` into a reference t= o `Self`. + /// + /// # Safety + /// + /// `self_ptr` must be a valid pointer to `Self`. + unsafe fn as_ref<'a>(self_ptr: *mut bindings::drm_gem_object) -> &'a S= elf; } =20 /// Trait which must be implemented by drivers using base GEM objects. @@ -63,14 +67,13 @@ extern "C" fn open_callback, U: = BaseObject>( let file =3D unsafe { drm::File::<<::Driver as drm::Driver>::File>::= as_ref(raw_file) }; - let obj =3D - <<::Driver as drm::Driver>::Object as IntoGEMO= bject>::from_gem_obj( - raw_obj, - ); - - // SAFETY: `from_gem_obj()` returns a valid pointer as long as the typ= e is correct and the - // `raw_obj` we got is valid. - match T::open(unsafe { &*obj }, file) { + // SAFETY: `open_callback` is specified in the AllocOps structure for = `Object`, ensuring that + // `raw_obj` is indeed contained within a `Object`. + let obj =3D unsafe { + <<::Driver as drm::Driver>::Object as IntoGEMO= bject>::as_ref(raw_obj) + }; + + match T::open(obj, file) { Err(e) =3D> e.to_errno(), Ok(()) =3D> 0, } @@ -84,14 +87,13 @@ extern "C" fn close_callback, U:= BaseObject>( let file =3D unsafe { drm::File::<<::Driver as drm::Driver>::File>::= as_ref(raw_file) }; - let obj =3D - <<::Driver as drm::Driver>::Object as IntoGEMO= bject>::from_gem_obj( - raw_obj, - ); - - // SAFETY: `from_gem_obj()` returns a valid pointer as long as the typ= e is correct and the - // `raw_obj` we got is valid. - T::close(unsafe { &*obj }, file); + // SAFETY: `close_callback` is specified in the AllocOps structure for= `Object`, ensuring + // that `raw_obj` is indeed contained within a `Object`. + let obj =3D unsafe { + <<::Driver as drm::Driver>::Object as IntoGEMO= bject>::as_ref(raw_obj) + }; + + T::close(obj, file); } =20 impl IntoGEMObject for Object { @@ -101,9 +103,10 @@ fn into_gem_obj(&self) -> &Opaque { &self.obj } =20 - fn from_gem_obj(obj: *mut bindings::drm_gem_object) -> *mut Self { - // SAFETY: All of our objects are Object. - unsafe { crate::container_of!(obj, Object, obj).cast_mut() } + unsafe fn as_ref<'a>(self_ptr: *mut bindings::drm_gem_object) -> &'a S= elf { + // SAFETY: `obj` is guaranteed to be in an `Object` via the saf= ety contract of this + // function + unsafe { &*crate::container_of!(self_ptr, Object, obj) } } } =20 @@ -144,11 +147,25 @@ fn lookup_handle( ) -> Result> { // SAFETY: The arguments are all valid per the type invariants. let ptr =3D unsafe { bindings::drm_gem_object_lookup(file.as_raw()= .cast(), handle) }; - let ptr =3D ::from_gem_obj(ptr); - let ptr =3D NonNull::new(ptr).ok_or(ENOENT)?; =20 - // SAFETY: We take ownership of the reference of `drm_gem_object_l= ookup()`. - Ok(unsafe { ARef::from_raw(ptr) }) + // SAFETY: + // - A `drm::Driver` can only have a single `File` implementation. + // - `file` uses the same `drm::Driver` as `Self`. + // - Therefore, we're guaranteed that `ptr` must be a gem object e= mbedded within `Self`. + // - And we check if the pointer is null befoe calling as_ref(), e= nsuring that `ptr` is a + // valid pointer to an initialized `Self`. + // XXX: The expect lint here is to workaround + // https://github.com/rust-lang/rust-clippy/issues/13024 + #[expect(clippy::undocumented_unsafe_blocks)] + let obj =3D (!ptr.is_null()) + .then(|| unsafe { Self::as_ref(ptr) }) + .ok_or(ENOENT)?; + + // SAFETY: + // - We take ownership of the reference of `drm_gem_object_lookup(= )`. + // - Our `NonNull` comes from an immutable reference, thus ensurin= g it is a valid pointer to + // `Self`. + Ok(unsafe { ARef::from_raw(obj.into()) }) } =20 /// Creates an mmap offset to map the object from userspace. --=20 2.48.1