Commit 1d24eb2d authored by Alice Ryhl's avatar Alice Ryhl Committed by Miguel Ojeda
Browse files

rust: delete `ForeignOwnable::borrow_mut` 



We discovered that the current design of `borrow_mut` is problematic.
This patch removes it until a better solution can be found.

Specifically, the current design gives you access to a `&mut T`, which
lets you change where the `ForeignOwnable` points (e.g., with
`core::mem::swap`). No upcoming user of this API intended to make that
possible, making all of them unsound.

Signed-off-by: default avatarAlice Ryhl <aliceryhl@google.com>
Reviewed-by: default avatarGary Guo <gary@garyguo.net>
Reviewed-by: default avatarBenno Lossin <benno.lossin@proton.me>
Reviewed-by: default avatarMartin Rodriguez Reboredo <yakoyoku@gmail.com>
Fixes: 0fc4424d ("rust: types: introduce `ForeignOwnable`")
Link: https://lore.kernel.org/r/20230706094615.3080784-1-aliceryhl@google.com


Signed-off-by: default avatarMiguel Ojeda <ojeda@kernel.org>
parent b3d8aa84

rust/kernel/sync/arc.rs

+1 −2
Original line number Diff line number Diff line
@@ -243,8 +243,7 @@ impl<T: 'static> ForeignOwnable for Arc<T> { 
        let inner = NonNull::new(ptr as *mut ArcInner<T>).unwrap();



        // SAFETY: The safety requirements of `from_foreign` ensure that the object remains alive

        // for the lifetime of the returned value. Additionally, the safety requirements of

        // `ForeignOwnable::borrow_mut` ensure that no new mutable references are created.

        // for the lifetime of the returned value.

        unsafe { ArcBorrow::new(inner) }

    }

rust/kernel/types.rs

+2 −20
Original line number Diff line number Diff line
@@ -35,34 +35,16 @@ pub trait ForeignOwnable: Sized { 
    ///

    /// `ptr` must have been returned by a previous call to [`ForeignOwnable::into_foreign`] for

    /// which a previous matching [`ForeignOwnable::from_foreign`] hasn't been called yet.

    /// Additionally, all instances (if any) of values returned by [`ForeignOwnable::borrow_mut`]

    /// for this object must have been dropped.

    unsafe fn borrow<'a>(ptr: *const core::ffi::c_void) -> Self::Borrowed<'a>;



    /// Mutably borrows a foreign-owned object.

    ///

    /// # Safety

    ///

    /// `ptr` must have been returned by a previous call to [`ForeignOwnable::into_foreign`] for

    /// which a previous matching [`ForeignOwnable::from_foreign`] hasn't been called yet.

    /// Additionally, all instances (if any) of values returned by [`ForeignOwnable::borrow`] and

    /// [`ForeignOwnable::borrow_mut`] for this object must have been dropped.

    unsafe fn borrow_mut(ptr: *const core::ffi::c_void) -> ScopeGuard<Self, fn(Self)> {

        // SAFETY: The safety requirements ensure that `ptr` came from a previous call to

        // `into_foreign`.

        ScopeGuard::new_with_data(unsafe { Self::from_foreign(ptr) }, |d| {

            d.into_foreign();

        })

    }



    /// Converts a foreign-owned object back to a Rust-owned one.

    ///

    /// # Safety

    ///

    /// `ptr` must have been returned by a previous call to [`ForeignOwnable::into_foreign`] for

    /// which a previous matching [`ForeignOwnable::from_foreign`] hasn't been called yet.

    /// Additionally, all instances (if any) of values returned by [`ForeignOwnable::borrow`] and

    /// [`ForeignOwnable::borrow_mut`] for this object must have been dropped.

    /// Additionally, all instances (if any) of values returned by [`ForeignOwnable::borrow`] for

    /// this object must have been dropped.

    unsafe fn from_foreign(ptr: *const core::ffi::c_void) -> Self;

}