Commit 8802e168 authored by Alice Ryhl's avatar Alice Ryhl Committed by Miguel Ojeda
Browse files

rust: types: add Opaque::cast_from 



Since commit b20fbbc0 ("rust: check type of `$ptr` in
`container_of!`") we have enforced that the field pointer passed to
container_of! must match the declared field. This caused mismatches when
using a pointer to bindings::x for fields of type Opaque<bindings::x>.

This situation encourages the user to simply pass field.cast() to the
container_of! macro, but this is not great because you might
accidentally pass a *mut bindings::y when the field type is
Opaque<bindings::x>, which would be wrong.

To help catch this kind of mistake, add a new Opaque::cast_from that
wraps a raw pointer in Opaque without changing the inner type. Also
update the docs to reflect this as well as some existing users.

Signed-off-by: default avatarAlice Ryhl <aliceryhl@google.com>
Acked-by: default avatarAndreas Hindborg <a.hindborg@kernel.org>
Acked-by: default avatarBoqun Feng <boqun.feng@gmail.com>
Reviewed-by: default avatarDanilo Krummrich <dakr@kernel.org>
Acked-by: default avatarDanilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20250624-opaque-from-raw-v2-1-e4da40bdc59c@google.com


Signed-off-by: default avatarMiguel Ojeda <ojeda@kernel.org>
parent a68a6bef

rust/kernel/drm/device.rs

+1 −3
Original line number Diff line number Diff line
@@ -135,11 +135,9 @@ pub(crate) fn as_raw(&self) -> *mut bindings::drm_device { 
    ///

    /// `ptr` must be a valid pointer to a `struct device` embedded in `Self`.

    unsafe fn from_drm_device(ptr: *const bindings::drm_device) -> *mut Self {

        let ptr: *const Opaque<bindings::drm_device> = ptr.cast();



        // SAFETY: By the safety requirements of this function `ptr` is a valid pointer to a

        // `struct drm_device` embedded in `Self`.

        unsafe { crate::container_of!(ptr, Self, dev) }.cast_mut()

        unsafe { crate::container_of!(Opaque::cast_from(ptr), Self, dev) }.cast_mut()

    }



    /// Not intended to be called externally, except via declare_drm_ioctls!()

rust/kernel/drm/gem/mod.rs

+1 −3
Original line number Diff line number Diff line
@@ -125,11 +125,9 @@ fn as_raw(&self) -> *mut bindings::drm_gem_object { 
    }



    unsafe fn as_ref<'a>(self_ptr: *mut bindings::drm_gem_object) -> &'a Self {

        let self_ptr: *mut Opaque<bindings::drm_gem_object> = self_ptr.cast();



        // SAFETY: `obj` is guaranteed to be in an `Object<T>` via the safety contract of this

        // function

        unsafe { &*crate::container_of!(self_ptr, Object<T>, obj) }

        unsafe { &*crate::container_of!(Opaque::cast_from(self_ptr), Object<T>, obj) }

    }

}

rust/kernel/lib.rs

+7 −0
Original line number Diff line number Diff line
@@ -204,6 +204,13 @@ fn panic(info: &core::panic::PanicInfo<'_>) -> ! { 


/// Produces a pointer to an object from a pointer to one of its fields.

///

/// If you encounter a type mismatch due to the [`Opaque`] type, then use [`Opaque::raw_get`] or

/// [`Opaque::cast_from`] to resolve the mismatch.

///

/// [`Opaque`]: crate::types::Opaque

/// [`Opaque::raw_get`]: crate::types::Opaque::raw_get

/// [`Opaque::cast_from`]: crate::types::Opaque::cast_from

///

/// # Safety

///

/// The pointer passed to this macro, and the pointer returned by this macro, must both be in

rust/kernel/types.rs

+5 −0
Original line number Diff line number Diff line
@@ -413,6 +413,11 @@ pub const fn get(&self) -> *mut T { 
    pub const fn raw_get(this: *const Self) -> *mut T {

        UnsafeCell::raw_get(this.cast::<UnsafeCell<MaybeUninit<T>>>()).cast::<T>()

    }



    /// The opposite operation of [`Opaque::raw_get`].

    pub const fn cast_from(this: *const T) -> *const Self {

        this.cast()

    }

}



/// Types that are _always_ reference counted.