[PATCH 0/2] rust: kernel: add missing safety documentation

[PATCH 0/2] rust: kernel: add missing safety documentation

[Navaneeth K]

This series adds missing // SAFETY: comments to unsafe blocks in
the Rust kernel abstractions, replacing existing TODOs.

This aligns the code with the project's requirement that all
unsafe blocks must be documented with a safety rationale.

Navaneeth K (2):
  rust: kernel: document safety for rust_fmt_argument
  rust: kernel: document safety for as_str_unchecked

 rust/kernel/print.rs | 2 +-
 rust/kernel/str.rs   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

-- 
2.43.0

[PATCH 1/2] rust: kernel: document safety for rust_fmt_argument

[Navaneeth K]

Add a proper // SAFETY: comment for the unsafe pointer dereference in
rust_fmt_argument. The comment explains that the caller guarantees
the pointer validity, satisfying the Rust-for-Linux safety documentation
requirements.

Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
---
 rust/kernel/print.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/kernel/print.rs b/rust/kernel/print.rs
index 2d743d78d220..49fa87dfbce8 100644
--- a/rust/kernel/print.rs
+++ b/rust/kernel/print.rs
@@ -24,7 +24,7 @@
     use fmt::Write;
     // SAFETY: The C contract guarantees that `buf` is valid if it's less than `end`.
     let mut w = unsafe { RawFormatter::from_ptrs(buf.cast(), end.cast()) };
-    // SAFETY: TODO.
+    // SAFETY: The caller guarantees that `ptr` points to a valid `fmt::Arguments`.
     let _ = w.write_fmt(unsafe { *ptr.cast::<fmt::Arguments<'_>>() });
     w.pos().cast()
 }
-- 
2.43.0

Re: [PATCH 1/2] rust: kernel: document safety for rust_fmt_argument

[Miguel Ojeda]

On Sat, Nov 22, 2025 at 8:09 PM Navaneeth K <knavaneeth786@gmail.com> wrote:
>
> +    // SAFETY: The caller guarantees that `ptr` points to a valid `fmt::Arguments`.

Thanks for the patch!

The caller is indeed supposed to pass a proper `ptr`, but we should
actually require it, i.e. this line above:

    #[expect(clippy::missing_safety_doc)]

should be replaced with docs with a `# Safety` section that requires
it so that then we can apply the guarantee as you did in the `//
SAFETY:` doc.

Also, in addition to that parameter, we should double-check we put
enough safety preconditions on the other parameters. If we do that,
then we could also update the "C contract guarantees" safety comment
too to just refer to those.

(We could perhaps even mention in the C header that the safety
preconditions are written in the Rust docs for completeness.)

Cheers,
Miguel

[PATCH 2/2] rust: kernel: document safety for as_str_unchecked

[Navaneeth K]

Replace the TODO safety comment with a proper explanation.
The safety of from_utf8_unchecked relies on the caller guaranteeing
that the input bytes are valid UTF-8.

Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
---
 rust/kernel/str.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
index 5c74e5f77601..2801388c6bd1 100644
--- a/rust/kernel/str.rs
+++ b/rust/kernel/str.rs
@@ -385,7 +385,7 @@ pub fn to_str(&self) -> Result<&str, core::str::Utf8Error> {
     /// ```
     #[inline]
     pub unsafe fn as_str_unchecked(&self) -> &str {
-        // SAFETY: TODO.
+        // SAFETY: The caller guarantees that the contents are valid UTF-8.
         unsafe { core::str::from_utf8_unchecked(self.as_bytes()) }
     }
 
-- 
2.43.0

Re: [PATCH 2/2] rust: kernel: document safety for as_str_unchecked

[Alice Ryhl]

On Sat, Nov 22, 2025 at 07:09:08PM +0000, Navaneeth K wrote:
> Replace the TODO safety comment with a proper explanation.
> The safety of from_utf8_unchecked relies on the caller guaranteeing
> that the input bytes are valid UTF-8.
> 
> Signed-off-by: Navaneeth K <knavaneeth786@gmail.com>
> ---
>  rust/kernel/str.rs | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/rust/kernel/str.rs b/rust/kernel/str.rs
> index 5c74e5f77601..2801388c6bd1 100644
> --- a/rust/kernel/str.rs
> +++ b/rust/kernel/str.rs
> @@ -385,7 +385,7 @@ pub fn to_str(&self) -> Result<&str, core::str::Utf8Error> {
>      /// ```
>      #[inline]
>      pub unsafe fn as_str_unchecked(&self) -> &str {
> -        // SAFETY: TODO.
> +        // SAFETY: The caller guarantees that the contents are valid UTF-8.
>          unsafe { core::str::from_utf8_unchecked(self.as_bytes()) }

As far as I know another patch is deleting this method, so I don't think
there is anything to fix anymore.

Alice