Re: Can the Kernel Concurrency Sanitizer Own Rust Code?

On Thu, 7 Oct 2021 11:50:29 -0700
"Paul E. McKenney" [off-list ref] wrote:

I have updated https://paulmck.livejournal.com/64970.html accordingly
(and hopefully correctly), so thank you both!

The page writes:

... and furthermore safe code can violate unsafe code's assumptions as
long as it is in the same module. For all I know, this last caveat
might also apply to unsafe code in other modules for kernels built
with link-time optimizations (LTO) enabled.

This is incorrect.

The statement "safe code can violate unsafe code's assumptions as long
as it is in the same module" is true, but the "module" here means [Rust
module](https://doc.rust-lang.org/reference/items/modules.html) not
kernel module. Module is the encapsulation boundary in Rust, so code
can access things defined in the same module without visibility checks.

So take this file binding as an example,

	struct File {
	    ptr: *mut bindings::file,
	}

	impl File {
	    pub fn pos(&self) -> u64 {
	        unsafe { (*self.ptr).f_pos as u64 }
	    }
	}

The unsafe code assume ptr is valid. The default visibility is private,
so code in other modules cannot modify ptr directly. But within the
same module file.ptr can be accessed, so code within the same module
can use an invalid ptr and invalidate assumption.

This is purely syntactical, and have nothing to do with code generation
and LTO.

And this caveat could be easily be mitigated. In Rust-for-linux, these
structs have type invariant comments, and we require a comment
asserting that the invariant is upheld whenever these types are
modified or created directly with struct expression.

- Gary