From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B15BA3A3E95 for ; Wed, 29 Jul 2026 17:53:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785347612; cv=none; b=F1/vnPKbPz9df68frRYEbhWf6LSFlVFacFXNtHLeTs58Y8K3LkijPMUeNOnP8gFYmtxuLSkfKi0Mt0CE6TUYRvUL/fDnPhWzFLkPjyqRHJ4v+Dfv1zMw5Z0v+MbiAhkz9hObKFeHzd56VnltcbESdfgiJUZ+9BhmAIRzUsu9Xl0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785347612; c=relaxed/simple; bh=ZuhohfsfGK8qZ1od6jkDkls25a4U3lt9iE+o1rAw39o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fQ7p/7VMg9pHg6Nbac9tBXjQQoeSLbx5lsGvjgU6Zn6JR0C7e7f1BcvOIpJRpUt7Zg5BCczfneSBKTHJIlia55ymKEnqdK9bDF5Chii75ZTdg242YPsDm8jPS/Do/PpMy8xGq3Y3zh5wbRoccJ9g/5kFIGbHtW2flPNRt2kBNUg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YVeAwbkX; arc=none smtp.client-ip=209.85.221.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YVeAwbkX" Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-47c6e9a694bso860681f8f.1 for ; Wed, 29 Jul 2026 10:53:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785347607; x=1785952407; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9+S9PMJhfL90g3gQkXITMLd3dkVmP3fQHpI001CMZSI=; b=YVeAwbkX8txcjNgonal3BDDX/U4ihui3gqW7A1v/YfP0xSfSp2mqIhW2DM4EcSCPHj blXEVcUSjk2/o8tq/D0HakF1vh9lSJRlsItL++cYyCg0gwm0Ndaz5Rl0PmSV8VXX9tgS lrRtK8OIXwNNaVvsD8J/amU8uezVFKdA0IRBCunbkFK3fqZHRkqKX1c71lt3Sd1yg0Dm mUUg4jveHMyoLoYCT25rF/Qs7C96IfYgJSdtDEywztBeAkv4Wx8zmyB3L4hO8gxr1nE4 rs4S8KwdY4pwObzekFOAfzEN28FFb24baTAEMePQgKE4P1PUa10LtwZJ7zwcLQxl0HIL dIVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785347607; x=1785952407; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=9+S9PMJhfL90g3gQkXITMLd3dkVmP3fQHpI001CMZSI=; b=VeSApZnTviwTF3lWpxoSpbgFt6gHM+bfRl4EOaScdjptURZVq3CbsNRnljMIXEyLWR 18GqrZhxsHVMohLRUZjEDPnZopfMVJZonfiP3K6Y9VLxt/Xu8ZQ74SsEGGMN4PGLEKNc UJaKhTVOq7jnPk0XxMgwb3hqrOGk7guVKFE5nh9Xrc1URGlr+pPsLqWXivj1ykcZ5Nb4 jlrvlVNYlf6pRUlaWQt/McUp8MluKc63FNY2WXMeNLtIzV4D0Qn6rRrfjCi2gNqVi5g8 BlAk3KkV/ADl3HjBYOKIwNWLERHPWakAjSD4IWaOS0F/IHhSCinZbSYeIw4+s6d/MjIF 0D3A== X-Forwarded-Encrypted: i=1; AHgh+RrHAtm8ket/RmZbHc656IlK82a7HJsljbMjJppfDtHeTvLp3dO0hAcDfIG3nc3Po3PUlHwcqw8ViB5FSQk=@vger.kernel.org X-Gm-Message-State: AOJu0YzwG9wMzH89tgb8gsOR+7HU8vq6PfJVoTEbAJxuitX1qI9xku/8 TJl8ltj8VP97i41CWl84Pk2u7/RPH24Hg/T28O/NchkF/HhDf4oSLRWq X-Gm-Gg: AR+sD13C2+FtnA4IU0fVSwEluISs3MKcO6JHTBgDABIntCbcDSTtvvR40J4doghOY6/ C15DdFX08QI7IVBMgQP0dELGmM5A3/IISfhJEdiDmrEo5OoBtYaj99RLPbJyxYM5YlGiwG8ZrJw jBPIyX5twi/5gpe0WXKsj6BveY6wisJO29Hc0Ab8xrjNXBAgYvJ0PTUE4xZbS6VgvprM63xiWtK VoEzIy1ieD3wlSNchrFEtJHd6virllBFy/eWZdfXgX8kn/HvAk9xvcrUHiFnOUkLbA6Xrb/ZzRU Ua0G472PN/iGfzjn+T+tbWpiA3HlGfv2TX2IdJwWhAjN7lX+HcKTTgfyTqCbiKqpP64TLwZqt3L iEM19Dx8Nz8LTGSEGAAADuF11kOxCexmSP9rq0JVL3bPJekLf4UcsM6GP3wDztbIVKe7x2FwVZG /MRakOjOrUhkkB4r4maXq6LDR+3C/Dw5Pu6CrutY9ud48Z40Guqh1wvNuqDOw05WGyIPRDkNF+8 E3h3aaEucd/sOJ3Ks9xxFPlbjlTr9T2aW2wwaWW8W4= X-Received: by 2002:a5d:584a:0:b0:460:70ae:f1af with SMTP id ffacd0b85a97d-47fb1e9f9damr8878058f8f.27.1785347606865; Wed, 29 Jul 2026 10:53:26 -0700 (PDT) Received: from Cian.taile2c8f4.ts.net ([2a02:8084:d03:fa00:819d:8e1d:c966:142d]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47fb6acb6c9sm10833311f8f.13.2026.07.29.10.53.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Jul 2026 10:53:26 -0700 (PDT) From: cianM167 To: Miguel Ojeda Cc: Boqun Feng , Gary Guo , Alice Ryhl , Lyude Paul , Daniel Almeida , =?UTF-8?q?Onur=20=C3=96zkan?= , =?UTF-8?q?Bj=C3=B6rn=20Roy=20Baron?= , Benno Lossin , Andreas Hindborg , Trevor Gross , Danilo Krummrich , Tamir Duberstein , Alexandre Courbot , FUJITA Tomonori , Greg Kroah-Hartman , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, Cian McGuire Subject: [PATCH v4 2/4] rust: print: document safety of _printk FFI calls Date: Wed, 29 Jul 2026 18:53:05 +0100 Message-ID: <20260729175305.723486-1-cianmcguire167@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260726115929.82150-1-cianmcguire167@gmail.com> References: <20260726115929.82150-1-cianmcguire167@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Cian McGuire Two calls in this file had their SAFETY comments left as "TODO.": the cast back to `fmt::Arguments` in `rust_fmt_argument`, and the call to `bindings::_printk` in `call_printk`. `rust_fmt_argument` is only reachable through the `%pA` format specifier. Every in-tree Rust caller that uses `%pA` -- `call_printk`, `device::printk`, `kunit::printk`, and `seq_file::call_printf` -- invokes it synchronously with a pointer derived from its own live `fmt::Arguments`, as one call in a `switch` dispatch in `lib/vsprintf.c`'s pointer formatter that returns its result immediately; there is no deferred use or storage of the pointer on the C side. So the `fmt::Arguments` value stays alive on the caller's stack for the whole time `rust_fmt_argument` is running with `ptr` pointing at it. The `_printk` call itself is justified by this function's `# Safety` section, which this patch also tightens: `format_string` must be one of the non-continuation `format_strings` statics, not `format_strings::CONT`. `call_printk` always supplies two extra arguments -- `module_name` for `%s` and `args` for `%pA` -- which only matches the `"%s: %pA"` shape shared by every non-continuation string; `CONT`'s format string is `"%pA"` only, so passing it here would make `_printk` consume `module_name`'s pointer for `%pA` instead, and `rust_fmt_argument` would then reinterpret that `*const c_char` as a `*const fmt::Arguments` and dereference it. No caller does this today -- `call_printk` is only reached from `print_macro!`'s non-continuation arm; the continuation arm calls the separate, safe `call_printk_cont`, which hardcodes `CONT` together with the single argument it expects -- but the previous, broader contract permitted it. With `format_string` guaranteed non-`CONT`, and `module_name` guaranteed null-terminated by both of its possible origins (`kernel::__LOG_PREFIX` and the one generated by the `module!` proc macro), the specifiers always match the supplied arguments. Suggested-by: Miguel Ojeda Link: https://github.com/Rust-for-Linux/linux/issues/351 Signed-off-by: Cian McGuire --- v4: - Trim the `// SAFETY:` comment on the `_printk` call in `call_printk` down to what's specific to this call site (that `args` stays valid and is read back synchronously). The shape-matching reasoning it used to repeat is already covered by the `# Safety` section above it, which is the right place for it as a precondition rather than a per-call-site justification. (Gary Guo) v3: - Tightened `call_printk`'s `# Safety` contract to require a non-continuation format string (i.e. not `format_strings::CONT`), since the function always supplies both a `%s` and a `%pA` argument, which only matches the non-continuation strings' `"%s: %pA"` shape. Passing `CONT` under the old, broader contract would make `_printk` consume `module_name`'s pointer for `%pA` instead of `args`, which `rust_fmt_argument` would then wrongly reinterpret as a `*const fmt::Arguments` and dereference. Updated the inline SAFETY comment to match. v2: - Reworded the SAFETY comment on `rust_fmt_argument`'s cast to argue from the property that makes every `%pA` call site safe (synchronous invocation with a live `&fmt::Arguments`), instead of enumerating callers by name, so it doesn't go stale if a new caller is added. rust/kernel/print.rs | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/rust/kernel/print.rs b/rust/kernel/print.rs index 6fd84389a858..3111f8f4c2e1 100644 --- a/rust/kernel/print.rs +++ b/rust/kernel/print.rs @@ -29,7 +29,10 @@ use fmt::Write; // SAFETY: The C contract guarantees that `buf` is valid if it's less than `end`. let mut w = unsafe { RawFormatter::from_ptrs(buf.cast(), end.cast()) }; - // SAFETY: TODO. + // SAFETY: This function is only reachable via the `%pA` format specifier; using `%pA` from + // Rust requires the caller to invoke it synchronously with a `ptr` derived from a live + // `&fmt::Arguments`, before that reference's scope can end. `ptr` is therefore valid and + // properly aligned for a `fmt::Arguments<'_>` for the duration of this call. let _ = w.write_fmt(unsafe { *ptr.cast::>() }); w.pos().cast() } @@ -96,8 +99,11 @@ pub mod format_strings { /// /// # Safety /// -/// The format string must be one of the ones in [`format_strings`], and -/// the module name must be null-terminated. +/// The format string must be one of the non-continuation strings in +/// [`format_strings`] (i.e. not [`format_strings::CONT`]): this function +/// always supplies both `module_name` and `args` as arguments, which only +/// matches the `"%s: %pA"` shape used by the non-continuation strings, not +/// `CONT`'s `"%pA"`-only shape. The module name must be null-terminated. /// /// [`_printk`]: srctree/include/linux/_printk.h #[doc(hidden)] @@ -109,7 +115,9 @@ pub unsafe fn call_printk( ) { // `_printk` does not seem to fail in any path. #[cfg(CONFIG_PRINTK)] - // SAFETY: TODO. + // SAFETY: By this function's safety requirements, `format_string` and `module_name` match + // `_printk`'s expectations. `args` remains valid for the duration of this call and is only + // read back synchronously, through `%pA`, by `rust_fmt_argument`. unsafe { bindings::_printk( format_string.as_ptr(), -- 2.55.0