Received-SPF: pass (google.com: domain of linux-kernel+bounces-131145-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Thu, 04 Apr 2024 09:01:26 +0000
To: Laine Taffin Altman <alexanderaltman@me.com>, Miguel Ojeda <ojeda@kernel.org>, Alex Gaynor <alex.gaynor@gmail.com>, rust-for-linux@vger.kernel.org, Wedson Almeida Filho <wedsonaf@gmail.com>, Boqun Feng <boqun.feng@gmail.com>, Gary Guo <gary@garyguo.net>, =?utf-8?Q?Bj=C3=B6rn_Roy_Baron?= <bjorn3_gh@protonmail.com>, Andreas Hindborg <a.hindborg@samsung.com>, Alice Ryhl <aliceryhl@google.com>, Martin Rodriguez Reboredo <yakoyoku@gmail.com>, lkml <linux-kernel@vger.kernel.org>
From: Benno Lossin <benno.lossin@proton.me>
Cc: stable@vger.kernel.org
Subject: Re: [PATCH v4] rust: init: remove impl Zeroable for Infallible
Message-ID: <d3423fb5-c117-4bd1-9f86-db35590a0562@proton.me>
In-Reply-To: <CA160A4E-561E-4918-837E-3DCEBA74F808@me.com>
References: <CA160A4E-561E-4918-837E-3DCEBA74F808@me.com>
Feedback-ID: 71780778:user:proton
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 03.04.24 23:06, Laine Taffin Altman wrote:
> In Rust, producing an invalid value of any type is immediate undefined
> behavior (UB); this includes via zeroing memory.  Therefore, since an
> uninhabited type has no valid values, producing any values at all for it =
is
> UB.
>=20
> The Rust standard library type `core::convert::Infallible` is uninhabited=
,
> by virtue of having been declared as an enum with no cases, which always
> produces uninhabited types in Rust.
>=20
> The current kernel code allows this UB to be triggered, for example by co=
de
> like `Box::<core::convert::Infallible>::init(kernel::init::zeroed())`.
>=20
> Thus, remove the implementation of `Zeroable` for `Infallible`, thereby
> avoiding the unsoundness (potential for future UB).
>=20
> Cc: stable@vger.kernel.org
> Fixes: 38cde0bd7b67 ("rust: init: add `Zeroable` trait and `init::zeroed`=
 function")
> Closes: https://github.com/Rust-for-Linux/pinned-init/pull/13
> Signed-off-by: Laine Taffin Altman <alexanderaltman@me.com>
> Reviewed-by: Alice Ryhl <aliceryhl@google.com>
> Reviewed-by: Boqun Feng <boqun.feng@gmail.com>

Reviewed-by: Benno Lossin <benno.lossin@proton.me>

> ---
> V3 -> V4: Address review nits; run checkpatch properly.
> V2 -> V3: Email formatting correction.
> V1 -> V2: Added more documentation to the comment, with links; also added=
 more details to the commit message.
>=20
>  rust/kernel/init.rs | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
>=20
> diff --git a/rust/kernel/init.rs b/rust/kernel/init.rs
> index 424257284d16..3859c7ff81b7 100644
> --- a/rust/kernel/init.rs
> +++ b/rust/kernel/init.rs
> @@ -1292,8 +1292,15 @@ macro_rules! impl_zeroable {
>      i8, i16, i32, i64, i128, isize,
>      f32, f64,
>=20
> -    // SAFETY: These are ZSTs, there is nothing to zero.
> -    {<T: ?Sized>} PhantomData<T>, core::marker::PhantomPinned, Infallibl=
e, (),
> +    // Note: do not add uninhabited types (such as `!` or `core::convert=
::Infallible`) to this list;
> +    // creating an instance of an uninhabited type is immediate undefine=
d behavior.  For more on
> +    // uninhabited/empty types, consult The Rustonomicon:
> +    // https://doc.rust-lang.org/stable/nomicon/exotic-sizes.html#empty-=
types The Rust Reference
> +    // also has information on undefined behavior:
> +    // https://doc.rust-lang.org/stable/reference/behavior-considered-un=
defined.html
> +    //
> +    // SAFETY: These are inhabited ZSTs; there is nothing to zero and a =
valid value exists.
> +    {<T: ?Sized>} PhantomData<T>, core::marker::PhantomPinned, (),
>=20
>      // SAFETY: Type is allowed to take any value, including all zeros.
>      {<T>} MaybeUninit<T>,
>=20
> base-commit: c85af715cac0a951eea97393378e84bb49384734

I don't see this commit in the kernel tree, what did you specify as
`--base` when running `git format`?

--=20
Cheers,
Benno