From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f42.google.com (mail-wr1-f42.google.com [209.85.221.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9278A3A544B for ; Sun, 26 Jul 2026 11:59:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785067200; cv=none; b=uQCusfhjuVjvwtmREuKHAuMA72fLEhPWubpv+ytXbwGZS7Bi5UBraHY/dQxDr/xVJWNxfnG4SCiz7jkbb+GSVDEnj3ix1XZIGesVP7JrYlx0kID4fBbgw+hHcyEiOLiiAxib4PWFArhyys2Fs7V2khYpOeXRiN4gVPzRUxMhkrI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785067200; c=relaxed/simple; bh=JCLyLY8dgae/Sbwod2BMdY5luNYoPvnPa3MTPFhmmz4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=N+DPh9BrB1uUafqSAsYkuvd2ZGdlwfNsRhPopOxl8Pl5xyeQ2xnGaiVl8kz1pHwirRMoR3B2ItqSGjx2dv0zUgtzsj1jZqPvypfWR/mZZVdiHn+QJHmFRhTEs9/L6fCRvXk1v+a6c3ZWhuxynMfT1QOy0TxsdwgtfTM0ovhE3ew= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=myuEDAx9; arc=none smtp.client-ip=209.85.221.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="myuEDAx9" Received: by mail-wr1-f42.google.com with SMTP id ffacd0b85a97d-472326ca506so1200070f8f.2 for ; Sun, 26 Jul 2026 04:59:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785067197; x=1785671997; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=ADI/xa4fDOzHJVmDEfZGbvJQDEVg86zgIrIj9McDiRY=; b=myuEDAx9gQIoPH2Ijy6vqnSsVV3/datlDC8zpVAT8UzANc0ssXgYtZi++/iYTkFlqF mtM/fWvkbq+LyTUeukDTPqEDiDk5JF+D1pMxsQsVMUaZbgKxnvZG32iZJ6TxCRu04PVr n0rLDPKfZMR/5gPP7AXHTuAkliAZsW52IrMXdRuAJXSLS4T0G5A4iZxn8+wErZLRYUj8 CRMC5VVk1UQ1enM2GW2GvgUzCjQlGSlKSJ1kE6ZuJBaj5bbumdeCEMNPIFirphDarl4X lX244bJkMhTCVJu5RIxGSLGxB7vRGiwmjkhRgeqXQZC68tuKXD9pTw9l28rxTYu2lDm2 eNug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785067197; x=1785671997; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ADI/xa4fDOzHJVmDEfZGbvJQDEVg86zgIrIj9McDiRY=; b=XcObwnwkrfi5u/NzasyX8eY7Dorl1fxreCbCusKBbS33rxZZ0Snkin4Tqfl+85VBEQ gnfMhbfeXIVDXslk+b8oy2mjm+hTSOiglKUc84LpnVY/+FYnhIRlQQimcE9RbtPjecHn qugdTWxrJ4oyjAcskjy1zQqwWXT6Brypv8gysuc0Iabinz8PLaERFUK5cyqX8//sKtx4 JIzbcQ3UeeM7GnTDDvv3U0R//ysWQISIQll+P9go41q4Hvm9aHVS2LX7y8k4Q3T1BDvE cceaHhhqnH/SisoDcqNYkB7+h4l556i8ICHinV1HXVEhiGhlqbTUh4IVdL8UPjf2z0UC aXJQ== X-Forwarded-Encrypted: i=1; AHgh+RqUFJRalC81DMCQXLNcU4jbtfetdAUmMvkDnjmtc64EW37Q8Y6Ggo8t3CBakKI/tBZvW2IaOAihXa5LjQE=@vger.kernel.org X-Gm-Message-State: AOJu0YynwWl2YUI4Uf2yA1FEKVQ5mQWntTfVCqrMi367kIczsiEdOdZt 2ozHMii0i543CLTmxyzmhpsyn6YHyxwtrdoTShwo39mb3jWAPW72D8pd X-Gm-Gg: AR+sD10TSgpKkKDoLpnsmPHNMtxk/f/rPJlyTvApPb3jwPsfmemhFktuTLiSQ8GFUgF Ib1xB5ZH9EHcCJNR70ZPqhSPFo8fQD2ch/IvDYp6/K6M0lIwhmmpZnHk5peBLCBzyvCJmk5+qDx AKoGYr2uHinSial1MlHUINTIvSCmOS8qbB2gKpvrE3X4LOqpEuwx+D+EyDkyfME4LK6Y79NBhm/ 5pa6m7fHwcTAkM0ZKTrxW6u19E55m4joOZG3cvNBgYSQzoUVb4CO4lwSh8a6O7nuPzQPrz3K2la x9v6NElxbrlLGg8R4a70fk9cinPbqH0rFvVcxnWL/ARI/Xn+Pnwbx5XLzkOjl2u6gQy+0TF5OL+ RHlIskAjg6QN+E1jdy5X4A7VOZg1kb+S2wZrOCVzdg+UWbh7eLdnppspagJoKdCNLcy2weRPTBU HJS8KkXjGOzY7vYxV1LVFrspV+xpxKGoO2uXWBrZ0mEyz8HokOk2jPBR+f X-Received: by 2002:adf:e191:0:b0:47f:962a:9f4d with SMTP id ffacd0b85a97d-47f9fc8cee5mr6266416f8f.15.1785067196500; Sun, 26 Jul 2026 04:59:56 -0700 (PDT) Received: from Cian.taile2c8f4.ts.net ([2a02:8084:d03:fa00:819d:8e1d:c966:142d]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f85c6dc25sm39094265f8f.33.2026.07.26.04.59.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 26 Jul 2026 04:59:56 -0700 (PDT) From: Cian McGuire To: Miguel Ojeda Cc: Boqun Feng , Gary Guo , Alice Ryhl , Lyude Paul , Daniel Almeida , =?UTF-8?q?Onur=20=C3=96zkan?= , =?UTF-8?q?Bj=C3=B6rn=20Roy=20Baron?= , Benno Lossin , Andreas Hindborg , Trevor Gross , Danilo Krummrich , Tamir Duberstein , Alexandre Courbot , FUJITA Tomonori , Greg Kroah-Hartman , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, Cian McGuire Subject: [PATCH v3 2/4] rust: print: document safety of _printk FFI calls Date: Sun, 26 Jul 2026 12:59:29 +0100 Message-ID: <20260726115929.82150-1-cianmcguire167@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Two calls in this file had their SAFETY comments left as "TODO.": the cast back to `fmt::Arguments` in `rust_fmt_argument`, and the call to `bindings::_printk` in `call_printk`. `rust_fmt_argument` is only reachable through the `%pA` format specifier. Every in-tree Rust caller that uses `%pA` -- `call_printk`, `device::printk`, `kunit::printk`, and `seq_file::call_printf` -- invokes it synchronously with a pointer derived from its own live `fmt::Arguments`, as one call in a `switch` dispatch in `lib/vsprintf.c`'s pointer formatter that returns its result immediately; there is no deferred use or storage of the pointer on the C side. So the `fmt::Arguments` value stays alive on the caller's stack for the whole time `rust_fmt_argument` is running with `ptr` pointing at it. The `_printk` call itself is justified by this function's `# Safety` section, which this patch also tightens: `format_string` must be one of the non-continuation `format_strings` statics, not `format_strings::CONT`. `call_printk` always supplies two extra arguments -- `module_name` for `%s` and `args` for `%pA` -- which only matches the `"%s: %pA"` shape shared by every non-continuation string; `CONT`'s format string is `"%pA"` only, so passing it here would make `_printk` consume `module_name`'s pointer for `%pA` instead, and `rust_fmt_argument` would then reinterpret that `*const c_char` as a `*const fmt::Arguments` and dereference it. No caller does this today -- `call_printk` is only reached from `print_macro!`'s non-continuation arm; the continuation arm calls the separate, safe `call_printk_cont`, which hardcodes `CONT` together with the single argument it expects -- but the previous, broader contract permitted it. With `format_string` guaranteed non-`CONT`, and `module_name` guaranteed null-terminated by both of its possible origins (`kernel::__LOG_PREFIX` and the one generated by the `module!` proc macro), the specifiers always match the supplied arguments. Suggested-by: Miguel Ojeda Link: https://github.com/Rust-for-Linux/linux/issues/351 Signed-off-by: Cian McGuire --- v3: - Tightened `call_printk`'s `# Safety` contract to require a non-continuation format string (i.e. not `format_strings::CONT`), since the function always supplies both a `%s` and a `%pA` argument, which only matches the non-continuation strings' `"%s: %pA"` shape. Passing `CONT` under the old, broader contract would make `_printk` consume `module_name`'s pointer for `%pA` instead of `args`, which `rust_fmt_argument` would then wrongly reinterpret as a `*const fmt::Arguments` and dereference. Updated the inline SAFETY comment to match. v2: - Reworded the SAFETY comment on `rust_fmt_argument`'s cast to argue from the property that makes every `%pA` call site safe (synchronous invocation with a live `&fmt::Arguments`), instead of enumerating callers by name, so it doesn't go stale if a new caller is added. rust/kernel/print.rs | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/rust/kernel/print.rs b/rust/kernel/print.rs index 6fd84389a858..5a0ee103b54e 100644 --- a/rust/kernel/print.rs +++ b/rust/kernel/print.rs @@ -29,7 +29,10 @@ use fmt::Write; // SAFETY: The C contract guarantees that `buf` is valid if it's less than `end`. let mut w = unsafe { RawFormatter::from_ptrs(buf.cast(), end.cast()) }; - // SAFETY: TODO. + // SAFETY: This function is only reachable via the `%pA` format specifier; using `%pA` from + // Rust requires the caller to invoke it synchronously with a `ptr` derived from a live + // `&fmt::Arguments`, before that reference's scope can end. `ptr` is therefore valid and + // properly aligned for a `fmt::Arguments<'_>` for the duration of this call. let _ = w.write_fmt(unsafe { *ptr.cast::>() }); w.pos().cast() } @@ -96,8 +99,11 @@ pub mod format_strings { /// /// # Safety /// -/// The format string must be one of the ones in [`format_strings`], and -/// the module name must be null-terminated. +/// The format string must be one of the non-continuation strings in +/// [`format_strings`] (i.e. not [`format_strings::CONT`]): this function +/// always supplies both `module_name` and `args` as arguments, which only +/// matches the `"%s: %pA"` shape used by the non-continuation strings, not +/// `CONT`'s `"%pA"`-only shape. The module name must be null-terminated. /// /// [`_printk`]: srctree/include/linux/_printk.h #[doc(hidden)] @@ -109,7 +115,11 @@ pub unsafe fn call_printk( ) { // `_printk` does not seem to fail in any path. #[cfg(CONFIG_PRINTK)] - // SAFETY: TODO. + // SAFETY: By this function's safety requirements, `format_string` is one of the + // non-continuation `format_strings` statics (never `CONT`), so its fixed `"%s: %pA"` shape + // matches the two arguments supplied below: `module_name` is null-terminated as `%s` + // requires, and the third argument points at `args`, which remains valid for the duration + // of this call and is only read back synchronously, through `%pA`, by `rust_fmt_argument`. unsafe { bindings::_printk( format_string.as_ptr(), -- 2.55.0