Normally it is undefined behavior for a bool to take any value other
than 0 or 1. However, in the case of READ_ONCE(some_bool) is used, this
UB seems dangerous and unnecessary. I can easily imagine some Rust code
that looks like this:
if READ_ONCE(&raw const (*my_c_struct).my_bool_field) {
...
}
And by making an analogy to what the equivalent C code is, anyone
writing this probably just meant to treat any non-zero value as true.
For WRITE_ONCE no special logic is required.
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
---
rust/kernel/sync/rwonce.rs | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/rust/kernel/sync/rwonce.rs b/rust/kernel/sync/rwonce.rs
index a1660e43c9ef94011812d1816713cf031a73de1d..73477f53131926996614df573b2d50fff98e624f 100644
--- a/rust/kernel/sync/rwonce.rs
+++ b/rust/kernel/sync/rwonce.rs
@@ -163,6 +163,7 @@ unsafe fn write_once(ptr: *mut Self, val: Self) {
// sizes, so picking the wrong helper should lead to a build error.
impl_rw_once_type! {
+ bool, read_once_bool, write_once_1;
u8, read_once_1, write_once_1;
i8, read_once_1, write_once_1;
u16, read_once_2, write_once_2;
@@ -186,3 +187,21 @@ unsafe fn write_once(ptr: *mut Self, val: Self) {
usize, read_once_8, write_once_8;
isize, read_once_8, write_once_8;
}
+
+/// Read an integer as a boolean once.
+///
+/// Returns `true` if the value behind the pointer is non-zero. Otherwise returns `false`.
+///
+/// # Safety
+///
+/// It must be safe to `READ_ONCE` the `ptr` with type `u8`.
+#[inline(always)]
+#[track_caller]
+unsafe fn read_once_bool(ptr: *const bool) -> bool {
+ // Implement `read_once_bool` in terms of `read_once_1`. The arch-specific logic is inside
+ // of `read_once_1`.
+ //
+ // SAFETY: It is safe to `READ_ONCE` the `ptr` with type `u8`.
+ let byte = unsafe { read_once_1(ptr.cast::<u8>()) };
+ byte != 0u8
+}
--
2.52.0.351.gbe84eed79e-googOn Wed, Dec 31, 2025 at 12:22:27PM +0000, Alice Ryhl wrote:
> Normally it is undefined behavior for a bool to take any value other
> than 0 or 1. However, in the case of READ_ONCE(some_bool) is used, this
> UB seems dangerous and unnecessary. I can easily imagine some Rust code
> that looks like this:
>
> if READ_ONCE(&raw const (*my_c_struct).my_bool_field) {
> ...
> }
>
> And by making an analogy to what the equivalent C code is, anyone
> writing this probably just meant to treat any non-zero value as true.
>
> For WRITE_ONCE no special logic is required.
>
> Signed-off-by: Alice Ryhl <aliceryhl@google.com>
> ---
> rust/kernel/sync/rwonce.rs | 19 +++++++++++++++++++
> 1 file changed, 19 insertions(+)
>
> diff --git a/rust/kernel/sync/rwonce.rs b/rust/kernel/sync/rwonce.rs
> index a1660e43c9ef94011812d1816713cf031a73de1d..73477f53131926996614df573b2d50fff98e624f 100644
> --- a/rust/kernel/sync/rwonce.rs
> +++ b/rust/kernel/sync/rwonce.rs
> @@ -163,6 +163,7 @@ unsafe fn write_once(ptr: *mut Self, val: Self) {
> // sizes, so picking the wrong helper should lead to a build error.
>
> impl_rw_once_type! {
> + bool, read_once_bool, write_once_1;
> u8, read_once_1, write_once_1;
> i8, read_once_1, write_once_1;
> u16, read_once_2, write_once_2;
> @@ -186,3 +187,21 @@ unsafe fn write_once(ptr: *mut Self, val: Self) {
> usize, read_once_8, write_once_8;
> isize, read_once_8, write_once_8;
> }
> +
> +/// Read an integer as a boolean once.
> +///
> +/// Returns `true` if the value behind the pointer is non-zero. Otherwise returns `false`.
> +///
> +/// # Safety
> +///
> +/// It must be safe to `READ_ONCE` the `ptr` with type `u8`.
> +#[inline(always)]
> +#[track_caller]
> +unsafe fn read_once_bool(ptr: *const bool) -> bool {
> + // Implement `read_once_bool` in terms of `read_once_1`. The arch-specific logic is inside
> + // of `read_once_1`.
> + //
> + // SAFETY: It is safe to `READ_ONCE` the `ptr` with type `u8`.
> + let byte = unsafe { read_once_1(ptr.cast::<u8>()) };
> + byte != 0u8
> +}
Does this hardcode that sizeof(_Bool) == 1? There are ABIs where this is
not the case.
On Tue, 6 Jan 2026 13:43:26 +0100
Peter Zijlstra <peterz@infradead.org> wrote:
> On Wed, Dec 31, 2025 at 12:22:27PM +0000, Alice Ryhl wrote:
> > Normally it is undefined behavior for a bool to take any value other
> > than 0 or 1. However, in the case of READ_ONCE(some_bool) is used, this
> > UB seems dangerous and unnecessary. I can easily imagine some Rust code
> > that looks like this:
> >
> > if READ_ONCE(&raw const (*my_c_struct).my_bool_field) {
> > ...
> > }
> >
> > And by making an analogy to what the equivalent C code is, anyone
> > writing this probably just meant to treat any non-zero value as true.
> >
> > For WRITE_ONCE no special logic is required.
> >
> > Signed-off-by: Alice Ryhl <aliceryhl@google.com>
> > ---
> > rust/kernel/sync/rwonce.rs | 19 +++++++++++++++++++
> > 1 file changed, 19 insertions(+)
> >
> > diff --git a/rust/kernel/sync/rwonce.rs b/rust/kernel/sync/rwonce.rs
> > index a1660e43c9ef94011812d1816713cf031a73de1d..73477f53131926996614df573b2d50fff98e624f 100644
> > --- a/rust/kernel/sync/rwonce.rs
> > +++ b/rust/kernel/sync/rwonce.rs
> > @@ -163,6 +163,7 @@ unsafe fn write_once(ptr: *mut Self, val: Self) {
> > // sizes, so picking the wrong helper should lead to a build error.
> >
> > impl_rw_once_type! {
> > + bool, read_once_bool, write_once_1;
> > u8, read_once_1, write_once_1;
> > i8, read_once_1, write_once_1;
> > u16, read_once_2, write_once_2;
> > @@ -186,3 +187,21 @@ unsafe fn write_once(ptr: *mut Self, val: Self) {
> > usize, read_once_8, write_once_8;
> > isize, read_once_8, write_once_8;
> > }
> > +
> > +/// Read an integer as a boolean once.
> > +///
> > +/// Returns `true` if the value behind the pointer is non-zero. Otherwise returns `false`.
> > +///
> > +/// # Safety
> > +///
> > +/// It must be safe to `READ_ONCE` the `ptr` with type `u8`.
> > +#[inline(always)]
> > +#[track_caller]
> > +unsafe fn read_once_bool(ptr: *const bool) -> bool {
> > + // Implement `read_once_bool` in terms of `read_once_1`. The arch-specific logic is inside
> > + // of `read_once_1`.
> > + //
> > + // SAFETY: It is safe to `READ_ONCE` the `ptr` with type `u8`.
> > + let byte = unsafe { read_once_1(ptr.cast::<u8>()) };
> > + byte != 0u8
> > +}
>
> Does this hardcode that sizeof(_Bool) == 1? There are ABIs where this is
> not the case.
Hi Peter,
Do you have a concrete example on which ABI/arch this is not true?
I know that the C spec doesn't mandate _Bool and char are of the same size
but we have tons of assumptions that is not guaranteed by standard C..
Best,
Gary
On Tue, Jan 06, 2026 at 06:12:01PM +0000, Gary Guo wrote:
> On Tue, 6 Jan 2026 13:43:26 +0100
> Peter Zijlstra <peterz@infradead.org> wrote:
> > Does this hardcode that sizeof(_Bool) == 1? There are ABIs where this is
> > not the case.
>
> Hi Peter,
>
> Do you have a concrete example on which ABI/arch this is not true?
>
> I know that the C spec doesn't mandate _Bool and char are of the same size
> but we have tons of assumptions that is not guaranteed by standard C..
Darwin/PowerPC famously has sizeof(_Bool) == 4
Win32: Visual C++ 4.2 (and earlier) had sizeof(bool)==4 (they mapped
bool to int), while Visual C++ 5.0 introduced a native _Bool and moved
to 1 byte.
Early RISC CPUs (MIPS, PowerPC, Alpha) had severe penalties for byte
access and their compilers would've had sizeof(bool)=={4,8}.
I think AVR/Arduino also has sizeof(bool) == sizeof(int) which is 2.
On Wed, 7 Jan 2026 09:33:27 +0100
Peter Zijlstra <peterz@infradead.org> wrote:
> On Tue, Jan 06, 2026 at 06:12:01PM +0000, Gary Guo wrote:
> > On Tue, 6 Jan 2026 13:43:26 +0100
> > Peter Zijlstra <peterz@infradead.org> wrote:
>
> > > Does this hardcode that sizeof(_Bool) == 1? There are ABIs where this is
> > > not the case.
> >
> > Hi Peter,
> >
> > Do you have a concrete example on which ABI/arch this is not true?
> >
> > I know that the C spec doesn't mandate _Bool and char are of the same size
> > but we have tons of assumptions that is not guaranteed by standard C..
>
> Darwin/PowerPC famously has sizeof(_Bool) == 4
>
> Win32: Visual C++ 4.2 (and earlier) had sizeof(bool)==4 (they mapped
> bool to int), while Visual C++ 5.0 introduced a native _Bool and moved
> to 1 byte.
>
> Early RISC CPUs (MIPS, PowerPC, Alpha) had severe penalties for byte
> access and their compilers would've had sizeof(bool)=={4,8}.
>
> I think AVR/Arduino also has sizeof(bool) == sizeof(int) which is 2.
>
>
It sounds like that none of these matter for the kernel?
In which case I think it's good to keep the assertion; if someone is ought
to introduce a new arch where _Bool (or Rust bool) is not 1 then we should
know about it.
Best,
Gary
On Tue, Jan 06, 2026 at 01:43:26PM +0100, Peter Zijlstra wrote:
> On Wed, Dec 31, 2025 at 12:22:27PM +0000, Alice Ryhl wrote:
> > +/// Read an integer as a boolean once.
> > +///
> > +/// Returns `true` if the value behind the pointer is non-zero. Otherwise returns `false`.
> > +///
> > +/// # Safety
> > +///
> > +/// It must be safe to `READ_ONCE` the `ptr` with type `u8`.
> > +#[inline(always)]
> > +#[track_caller]
> > +unsafe fn read_once_bool(ptr: *const bool) -> bool {
> > + // Implement `read_once_bool` in terms of `read_once_1`. The arch-specific logic is inside
> > + // of `read_once_1`.
> > + //
> > + // SAFETY: It is safe to `READ_ONCE` the `ptr` with type `u8`.
> > + let byte = unsafe { read_once_1(ptr.cast::<u8>()) };
> > + byte != 0u8
> > +}
>
> Does this hardcode that sizeof(_Bool) == 1? There are ABIs where this is
> not the case.
Hm, it hardcodes that the Rust type called bool is sizeof(_) == 1.
Presumably bindgen will not translate _Bool to bool when it appears in C
types on such platforms. But I don't really know - I have not looked
into this case.
Alice
On Wed, 31 Dec 2025 12:22:27 +0000
Alice Ryhl <aliceryhl@google.com> wrote:
> Normally it is undefined behavior for a bool to take any value other
> than 0 or 1. However, in the case of READ_ONCE(some_bool) is used, this
> UB seems dangerous and unnecessary. I can easily imagine some Rust code
> that looks like this:
>
> if READ_ONCE(&raw const (*my_c_struct).my_bool_field) {
> ...
> }
>
> And by making an analogy to what the equivalent C code is, anyone
> writing this probably just meant to treat any non-zero value as true.
In C, bool can only hold value `false` and `true`, too, and putting
any other value there is going to be UB.
The C language provides automatic cast so when you write an integer to it,
non-zero values will cause `true` to be written. However, you're not
allowed to cast it into a char ptr and write other values into it.
So I think there shouldn't be any special treatment to boolean type in
this regard.
Best,
Gary
>
> For WRITE_ONCE no special logic is required.
>
> Signed-off-by: Alice Ryhl <aliceryhl@google.com>
> ---
> rust/kernel/sync/rwonce.rs | 19 +++++++++++++++++++
> 1 file changed, 19 insertions(+)
>
> diff --git a/rust/kernel/sync/rwonce.rs b/rust/kernel/sync/rwonce.rs
> index a1660e43c9ef94011812d1816713cf031a73de1d..73477f53131926996614df573b2d50fff98e624f 100644
> --- a/rust/kernel/sync/rwonce.rs
> +++ b/rust/kernel/sync/rwonce.rs
> @@ -163,6 +163,7 @@ unsafe fn write_once(ptr: *mut Self, val: Self) {
> // sizes, so picking the wrong helper should lead to a build error.
>
> impl_rw_once_type! {
> + bool, read_once_bool, write_once_1;
> u8, read_once_1, write_once_1;
> i8, read_once_1, write_once_1;
> u16, read_once_2, write_once_2;
> @@ -186,3 +187,21 @@ unsafe fn write_once(ptr: *mut Self, val: Self) {
> usize, read_once_8, write_once_8;
> isize, read_once_8, write_once_8;
> }
> +
> +/// Read an integer as a boolean once.
> +///
> +/// Returns `true` if the value behind the pointer is non-zero. Otherwise returns `false`.
> +///
> +/// # Safety
> +///
> +/// It must be safe to `READ_ONCE` the `ptr` with type `u8`.
> +#[inline(always)]
> +#[track_caller]
> +unsafe fn read_once_bool(ptr: *const bool) -> bool {
> + // Implement `read_once_bool` in terms of `read_once_1`. The arch-specific logic is inside
> + // of `read_once_1`.
> + //
> + // SAFETY: It is safe to `READ_ONCE` the `ptr` with type `u8`.
> + let byte = unsafe { read_once_1(ptr.cast::<u8>()) };
> + byte != 0u8
> +}
>
© 2016 - 2026 Red Hat, Inc.