mirror of
https://github.com/torvalds/linux.git
synced 2025-11-03 18:20:25 +02:00
331c24e6ce
Types that implement both `AsBytes` and `FromBytes` can be safely modified as a slice of bytes. Add a `as_bytes_mut` method for that purpose. [acourbot@nvidia.com: use fully qualified `core::mem::size_of_val` to build with Rust 1.78.] Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Reviewed-by: Benno Lossin <lossin@kernel.org> Acked-by: Miguel Ojeda <ojeda@kernel.org> Link: https://lore.kernel.org/r/20250801-as_bytes-v5-2-975f87d5dc85@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
96 lines
3.5 KiB
Rust
96 lines
3.5 KiB
Rust
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
//! Traits for transmuting types.
|
|
|
|
/// Types for which any bit pattern is valid.
|
|
///
|
|
/// Not all types are valid for all values. For example, a `bool` must be either zero or one, so
|
|
/// reading arbitrary bytes into something that contains a `bool` is not okay.
|
|
///
|
|
/// It's okay for the type to have padding, as initializing those bytes has no effect.
|
|
///
|
|
/// # Safety
|
|
///
|
|
/// All bit-patterns must be valid for this type. This type must not have interior mutability.
|
|
pub unsafe trait FromBytes {}
|
|
|
|
macro_rules! impl_frombytes {
|
|
($($({$($generics:tt)*})? $t:ty, )*) => {
|
|
// SAFETY: Safety comments written in the macro invocation.
|
|
$(unsafe impl$($($generics)*)? FromBytes for $t {})*
|
|
};
|
|
}
|
|
|
|
impl_frombytes! {
|
|
// SAFETY: All bit patterns are acceptable values of the types below.
|
|
u8, u16, u32, u64, usize,
|
|
i8, i16, i32, i64, isize,
|
|
|
|
// SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
|
|
// patterns are also acceptable for arrays of that type.
|
|
{<T: FromBytes>} [T],
|
|
{<T: FromBytes, const N: usize>} [T; N],
|
|
}
|
|
|
|
/// Types that can be viewed as an immutable slice of initialized bytes.
|
|
///
|
|
/// If a struct implements this trait, then it is okay to copy it byte-for-byte to userspace. This
|
|
/// means that it should not have any padding, as padding bytes are uninitialized. Reading
|
|
/// uninitialized memory is not just undefined behavior, it may even lead to leaking sensitive
|
|
/// information on the stack to userspace.
|
|
///
|
|
/// The struct should also not hold kernel pointers, as kernel pointer addresses are also considered
|
|
/// sensitive. However, leaking kernel pointers is not considered undefined behavior by Rust, so
|
|
/// this is a correctness requirement, but not a safety requirement.
|
|
///
|
|
/// # Safety
|
|
///
|
|
/// Values of this type may not contain any uninitialized bytes. This type must not have interior
|
|
/// mutability.
|
|
pub unsafe trait AsBytes {
|
|
/// Returns `self` as a slice of bytes.
|
|
fn as_bytes(&self) -> &[u8] {
|
|
// CAST: `Self` implements `AsBytes` thus all bytes of `self` are initialized.
|
|
let data = core::ptr::from_ref(self).cast::<u8>();
|
|
let len = core::mem::size_of_val(self);
|
|
|
|
// SAFETY: `data` is non-null and valid for reads of `len * sizeof::<u8>()` bytes.
|
|
unsafe { core::slice::from_raw_parts(data, len) }
|
|
}
|
|
|
|
/// Returns `self` as a mutable slice of bytes.
|
|
fn as_bytes_mut(&mut self) -> &mut [u8]
|
|
where
|
|
Self: FromBytes,
|
|
{
|
|
// CAST: `Self` implements both `AsBytes` and `FromBytes` thus making `Self`
|
|
// bi-directionally transmutable to `[u8; size_of_val(self)]`.
|
|
let data = core::ptr::from_mut(self).cast::<u8>();
|
|
let len = core::mem::size_of_val(self);
|
|
|
|
// SAFETY: `data` is non-null and valid for read and writes of `len * sizeof::<u8>()`
|
|
// bytes.
|
|
unsafe { core::slice::from_raw_parts_mut(data, len) }
|
|
}
|
|
}
|
|
|
|
macro_rules! impl_asbytes {
|
|
($($({$($generics:tt)*})? $t:ty, )*) => {
|
|
// SAFETY: Safety comments written in the macro invocation.
|
|
$(unsafe impl$($($generics)*)? AsBytes for $t {})*
|
|
};
|
|
}
|
|
|
|
impl_asbytes! {
|
|
// SAFETY: Instances of the following types have no uninitialized portions.
|
|
u8, u16, u32, u64, usize,
|
|
i8, i16, i32, i64, isize,
|
|
bool,
|
|
char,
|
|
str,
|
|
|
|
// SAFETY: If individual values in an array have no uninitialized portions, then the array
|
|
// itself does not have any uninitialized portions either.
|
|
{<T: AsBytes>} [T],
|
|
{<T: AsBytes, const N: usize>} [T; N],
|
|
}
|