Commit 88d5d6a3 authored by Tamir Duberstein's avatar Tamir Duberstein Committed by Danilo Krummrich
Browse files

rust: alloc: replace `Vec::set_len` with `inc_len` 



Rename `set_len` to `inc_len` and simplify its safety contract.

Note that the usage in `CString::try_from_fmt` remains correct as the
receiver is known to have `len == 0`.

Reviewed-by: default avatarAlice Ryhl <aliceryhl@google.com>
Signed-off-by: default avatarTamir Duberstein <tamird@gmail.com>
Link: https://lore.kernel.org/r/20250416-vec-set-len-v4-4-112b222604cd@gmail.com


Signed-off-by: default avatarDanilo Krummrich <dakr@kernel.org>
parent 1b04b466

rust/kernel/alloc/kvec.rs

+12 −13
Original line number Diff line number Diff line
@@ -185,20 +185,19 @@ pub fn len(&self) -> usize { 
        self.len

    }



    /// Forcefully sets `self.len` to `new_len`.

    /// Increments `self.len` by `additional`.

    ///

    /// # Safety

    ///

    /// - `new_len` must be less than or equal to [`Self::capacity`].

    /// - If `new_len` is greater than `self.len`, all elements within the interval

    ///   [`self.len`,`new_len`) must be initialized.

    /// - `additional` must be less than or equal to `self.capacity - self.len`.

    /// - All elements within the interval [`self.len`,`self.len + additional`) must be initialized.

    #[inline]

    pub unsafe fn set_len(&mut self, new_len: usize) {

        debug_assert!(new_len <= self.capacity());



        // INVARIANT: By the safety requirements of this method `new_len` represents the exact

        // number of elements stored within `self`.

        self.len = new_len;

    pub unsafe fn inc_len(&mut self, additional: usize) {

        // Guaranteed by the type invariant to never underflow.

        debug_assert!(additional <= self.capacity() - self.len());

        // INVARIANT: By the safety requirements of this method this represents the exact number of

        // elements stored within `self`.

        self.len += additional;

    }



    /// Decreases `self.len` by `count`.
@@ -317,7 +316,7 @@ pub fn push(&mut self, v: T, flags: Flags) -> Result<(), AllocError> { 
        // SAFETY: We just initialised the first spare entry, so it is safe to increase the length

        // by 1. We also know that the new length is <= capacity because of the previous call to

        // `reserve` above.

        unsafe { self.set_len(self.len() + 1) };

        unsafe { self.inc_len(1) };

        Ok(())

    }
@@ -521,7 +520,7 @@ pub fn extend_with(&mut self, n: usize, value: T, flags: Flags) -> Result<(), Al 
        // SAFETY:

        // - `self.len() + n < self.capacity()` due to the call to reserve above,

        // - the loop and the line above initialized the next `n` elements.

        unsafe { self.set_len(self.len() + n) };

        unsafe { self.inc_len(n) };



        Ok(())

    }
@@ -552,7 +551,7 @@ pub fn extend_from_slice(&mut self, other: &[T], flags: Flags) -> Result<(), All 
        //   the length by the same number.

        // - `self.len() + other.len() <= self.capacity()` is guaranteed by the preceding `reserve`

        //   call.

        unsafe { self.set_len(self.len() + other.len()) };

        unsafe { self.inc_len(other.len()) };

        Ok(())

    }

rust/kernel/str.rs

+1 −1
Original line number Diff line number Diff line
@@ -886,7 +886,7 @@ pub fn try_from_fmt(args: fmt::Arguments<'_>) -> Result<Self, Error> { 


        // SAFETY: The number of bytes that can be written to `f` is bounded by `size`, which is

        // `buf`'s capacity. The contents of the buffer have been initialised by writes to `f`.

        unsafe { buf.set_len(f.bytes_written()) };

        unsafe { buf.inc_len(f.bytes_written()) };



        // Check that there are no `NUL` bytes before the end.

        // SAFETY: The buffer is valid for read because `f.bytes_written()` is bounded by `size`

rust/kernel/uaccess.rs

+1 −1
Original line number Diff line number Diff line
@@ -290,7 +290,7 @@ pub fn read_all<A: Allocator>(mut self, buf: &mut Vec<u8, A>, flags: Flags) -> R 


        // SAFETY: Since the call to `read_raw` was successful, so the next `len` bytes of the

        // vector have been initialized.

        unsafe { buf.set_len(buf.len() + len) };

        unsafe { buf.inc_len(len) };

        Ok(())

    }

}