From nobody Tue Jun 16 15:55:44 2026 Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9170A4014B7 for ; Thu, 30 Apr 2026 11:54:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777550100; cv=none; b=FjSzGiU+YuHz8LLQcA9Y9aIHGmaExy/arQfHVFSFlmDlieXhyVfUWVkmZKZrNAetUvpVrQsHzM6ElrNnbz2UaDdv6xwdWoC7mNkSO8/wi6Ej9O/kB/k+jWGoEwo66gJ9Lb4GIFzlrPpsPQFBNZ8rJ1EkYB3zYi29ReY0R5/I2hw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777550100; c=relaxed/simple; bh=RDknWmxdKOa3LqUMYOu70zP7u63JJfaI07G9XJVySOg=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=kVKaH0CdfixRfIDVdPUPVVZV3VQbb633GatZWvUwCTkehoWOYVcTenkw5QbZwnq9xOOp8eliLlcsmpf6GJ9tWhAIOX0W1tHIKYp3KHpBONvbHq+FtM/WnEHSLz5H+8o/MoX+Oq9kchEiviJfAHIjAfdtjLP0RugxBtrsvADcoxk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=EqkZyjoX; arc=none smtp.client-ip=209.85.215.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EqkZyjoX" Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-c7971d0d97dso460006a12.1 for ; Thu, 30 Apr 2026 04:54:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777550096; x=1778154896; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=Cem4kav4PdWwCLcw2P7tm2Percbrzam0vx8aoqsFsis=; b=EqkZyjoXgk8NEd815HOKZCLb3T6QRFxMSw2WJyfDYbrG3/tCA8VcgXcnZcYfeIVu4t qANoedogbYzFTkh5RbjDyTtLbMXc6RaE7+1TSctUv2Ml7RFt5E+oec94MlqNdvWKo9in VctnZq/WNt20H4TLsOETml0dE3wSRn6CyRBho8+EDXzrb2hw8/pE6C8gcTaFa6Q2pB0x DeHVxS3UMaXW1chI0eENufSdcxupjaQfX7qGbdsifyFaB0o6AWH8aLlZnStu2/gxIxmm qNCFqjjBoyRydbakdLttgwqMZLiYZPrP5ZuvoV2Eoq0g8eSuQ7hF2bWGcQ946SpiDCnW oW/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777550096; x=1778154896; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Cem4kav4PdWwCLcw2P7tm2Percbrzam0vx8aoqsFsis=; b=CXcNznKXXlyjlHNYx7uTxr4TwJ01KdoJ5ivGot0D/XFbajdOSpM07HnLjXwUUZ02n6 otwrFnTJfsKkN4SyFrDlu3WH/TgOxl8pkPKiBueZhGAAi/77Ong0cIvdAsOOgKoyOFta Besc8GennNYoo0+YX7fstLuyvlO1gxdpMMkUO7BMK4Bdjh7iO0AKUXK3gUek35ljCbQa EpG0OH8ydlwwVvi9T69jYKexhHa23lp1PlqHwrcpmuX7M5iqbNS6MP8A4znFNbwRNiva pGJ3473J6klvRa6sojygE5/tFeuWIOzOFMJ0Vg1plkiikgOWey+Aqhc2WFACs9ToyhOb 5pPw== X-Forwarded-Encrypted: i=1; AFNElJ9EH1pjvAvucmVe3ZrrJXKXurgk5uwjMxUqHf7gL7cikFKutXCu7sN9noiIeg33vb5OG/hqpgT1gQzlVsI=@vger.kernel.org X-Gm-Message-State: AOJu0YxHDbPVOcFmJ7S2iBFfMt8mZSZgFPPDKTfUg46m4Nmf9WfgFEN9 i+Hp6vs6z5xseQA6wYqt+Q7cEhqD2z5ycgOtm9DVwjQS5r4AQaditxlS X-Gm-Gg: AeBDiesFMiu8i9xTZTtunLBwZKEiV4ZGUwuN7Fu+TtB39A7N0udzg0OmraRbhY5ZU1D nQ0BeDUU8jtgqtSdxOVBiI2JTwKrmABnWoPu23KLDokuGKwut1EXYTNRWQRTspJPyEf3NF44+bC CBL6HSjOv+0oiC0k2yvZ+PG6cgrr0yD8bmcZffzBVe4zgbFJbjTUq9hw74jk1fiIgSAz/afzqt1 mZXG7eFq2OfpkA2Yaw/N5C29lbjYk4fhPm/zCP1nl7rd+W+M/0RtDklu34YALLdWyrRBoQPQUYT intU/9oz8X1YAIXvnb7xcFpq/F1ZYLa5tDFOYoGY2cC2HaHSraeFM3BaYmcOM5K6sZqDppi7rR7 N5baIgJTRjTCppe/Z0tcvyTTaCfLgCd84QK5DYSZ4IcjZ4lkjma+rj+AfPPakAIOVsz/7sSO7s9 FFt4AlyAAFxaQ2HmaGlBvaCsTABfBtMKqFHNxOfUOH1aKLVT18vbL0JVImf+oUnQ== X-Received: by 2002:a05:6a21:ec4f:10b0:3a2:d838:bfdb with SMTP id adf61e73a8af0-3a3cf7caa2cmr2284806637.29.1777550096136; Thu, 30 Apr 2026 04:54:56 -0700 (PDT) Received: from Nighthawk.localdomain ([223.178.220.204]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-834ed810888sm4923352b3a.61.2026.04.30.04.54.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 30 Apr 2026 04:54:55 -0700 (PDT) From: Sagar Taunk To: Miguel Ojeda , Boqun Feng , Gary Guo , =?UTF-8?q?Bj=C3=B6rn=20Roy=20Baron?= , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich , Tamir Duberstein , Sagar Taunk , Daniel Almeida , Viresh Kumar , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] rust: workqueue: document SAFETY for `RawWorkItem` impl on `Pin>` Date: Thu, 30 Apr 2026 17:24:27 +0530 Message-ID: <20260430115428.48087-1-sagartaunk2@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The `RawWorkItem` implementation for `Pin>` left a `SAFETY: TODO` comment. This patch documents the safety requirements that make this implementation sound. The `work_struct` raw pointer is valid for the duration of the closure call because it comes from a `KBox` allocation that is not dropped by `__enqueue` itself. Since `Pin>` requires exclusive ownership, the work item cannot already be queued, so `queue_work_on` always returns true and the pointer remains valid until `WorkItemPointer::run` is called, where it is reclaimed via `KBox::from_raw`. Signed-off-by: Sagar Taunk --- rust/kernel/workqueue.rs | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/rust/kernel/workqueue.rs b/rust/kernel/workqueue.rs index 676ade0539e3..7554601cb968 100644 --- a/rust/kernel/workqueue.rs +++ b/rust/kernel/workqueue.rs @@ -910,7 +910,14 @@ unsafe impl WorkItemPointer for = Pin> } } =20 -// SAFETY: TODO. +// SAFETY: The `work_struct` raw pointer is guaranteed to be valid for the= duration of the call to +// the closure because it comes from a `KBox` which guarantees a valid = heap allocation, +// and we don't drop the allocation ourselves. It is further guaranteed to= be valid until +// a call to the function pointer in `work_struct` because we leak the mem= ory it points to. +// Since `Pin>` requires exclusive ownership, the work item cannot= already be queued, +// so `queue_work_on` always returns true, and we only reclaim the pointer= in +// `WorkItemPointer::run`, which is what the function pointer in the `work= _struct` must be +// pointing to, according to the safety requirements of `WorkItemPointer`. unsafe impl RawWorkItem for Pin> where T: WorkItem, --=20 2.54.0