Commit b03917e0 authored by Konstantin Andrikopoulos's avatar Konstantin Andrikopoulos Committed by Tejun Heo
Browse files

rust: add safety comment in workqueue traits 

Add missing safety comments for the implementation of the unsafe traits
WorkItemPointer and RawWorkItem for Arc<T> in workqueue.rs

Link: https://github.com/Rust-for-Linux/linux/issues/351

.
Co-developed-by: default avatarVangelis Mamalakis <mamalakis@google.com>
Signed-off-by: default avatarVangelis Mamalakis <mamalakis@google.com>
Suggested-by: default avatarMiguel Ojeda <ojeda@kernel.org>
Reviewed-by: default avatarAlice Ryhl <aliceryhl@google.com>
Signed-off-by: default avatarKonstantin Andrikopoulos <kernel@mandragore.io>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent 40384c84

rust/kernel/workqueue.rs

+16 −2
Original line number Diff line number Diff line
@@ -519,7 +519,15 @@ unsafe fn raw_get_work(ptr: *mut Self) -> *mut $crate::workqueue::Work<$work_typ 
    impl{T} HasWork<Self> for ClosureWork<T> { self.work }

}



// SAFETY: TODO.

// SAFETY: The `__enqueue` implementation in RawWorkItem uses a `work_struct` initialized with the

// `run` method of this trait as the function pointer because:

//   - `__enqueue` gets the `work_struct` from the `Work` field, using `T::raw_get_work`.

//   - The only safe way to create a `Work` object is through `Work::new`.

//   - `Work::new` makes sure that `T::Pointer::run` is passed to `init_work_with_key`.

//   - Finally `Work` and `RawWorkItem` guarantee that the correct `Work` field

//     will be used because of the ID const generic bound. This makes sure that `T::raw_get_work`

//     uses the correct offset for the `Work` field, and `Work::new` picks the correct

//     implementation of `WorkItemPointer` for `Arc<T>`.

unsafe impl<T, const ID: u64> WorkItemPointer<ID> for Arc<T>

where

    T: WorkItem<ID, Pointer = Self>,
@@ -537,7 +545,13 @@ unsafe impl<T, const ID: u64> WorkItemPointer<ID> for Arc<T> 
    }

}



// SAFETY: TODO.

// SAFETY: The `work_struct` raw pointer is guaranteed to be valid for the duration of the call to

// the closure because we get it from an `Arc`, which means that the ref count will be at least 1,

// and we don't drop the `Arc` ourselves. If `queue_work_on` returns true, it is further guaranteed

// to be valid until a call to the function pointer in `work_struct` because we leak the memory it

// points to, and only reclaim it if the closure returns false, or in `WorkItemPointer::run`, which

// is what the function pointer in the `work_struct` must be pointing to, according to the safety

// requirements of `WorkItemPointer`.

unsafe impl<T, const ID: u64> RawWorkItem<ID> for Arc<T>

where

    T: WorkItem<ID, Pointer = Self>,