[PATCH] rust: uaccess: avoid unsafe unwrap_unchecked() in strcpy_into_buf()

[PATCH] rust: uaccess: avoid unsafe unwrap_unchecked() in strcpy_into_buf()

[Thorsten Blum]

Since strcpy_into_buf() already rejects empty buffers, use ok_or()
instead of unwrap_unchecked() when NUL-terminating the buffer.

Signed-off-by: Thorsten Blum <blum@kernel.org>
---
 rust/kernel/uaccess.rs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/rust/kernel/uaccess.rs b/rust/kernel/uaccess.rs
index 5f6c4d7a1a51..2a0af795e75d 100644
--- a/rust/kernel/uaccess.rs
+++ b/rust/kernel/uaccess.rs
@@ -422,9 +422,7 @@ pub fn strcpy_into_buf<'buf>(self, buf: &'buf mut [u8]) -> Result<&'buf CStr> {
             // This means that we filled the buffer exactly. In this case, we add a NUL-terminator
             // and return it. Unlike the `len < dst.len()` branch, don't modify `len` because it
             // already represents the length including the NUL-terminator.
-            //
-            // SAFETY: Due to the check at the beginning, the buffer is not empty.
-            unsafe { *buf.last_mut().unwrap_unchecked() = 0 };
+            *buf.last_mut().ok_or(EINVAL)? = 0;
         }
 
         // This method consumes `self`, so it can only be called once, thus we do not need to

Re: [PATCH] rust: uaccess: avoid unsafe unwrap_unchecked() in strcpy_into_buf()

[Alexandre Courbot]

On Thu Oct 8, 2026 at 3:13 PM JST, Thorsten Blum wrote:
> Since strcpy_into_buf() already rejects empty buffers, use ok_or()
> instead of unwrap_unchecked() when NUL-terminating the buffer.
>
> Signed-off-by: Thorsten Blum <blum@kernel.org>
> ---
>  rust/kernel/uaccess.rs | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/rust/kernel/uaccess.rs b/rust/kernel/uaccess.rs
> index 5f6c4d7a1a51..2a0af795e75d 100644
> --- a/rust/kernel/uaccess.rs
> +++ b/rust/kernel/uaccess.rs
> @@ -422,9 +422,7 @@ pub fn strcpy_into_buf<'buf>(self, buf: &'buf mut [u8]) -> Result<&'buf CStr> {
>              // This means that we filled the buffer exactly. In this case, we add a NUL-terminator
>              // and return it. Unlike the `len < dst.len()` branch, don't modify `len` because it
>              // already represents the length including the NUL-terminator.
> -            //
> -            // SAFETY: Due to the check at the beginning, the buffer is not empty.
> -            unsafe { *buf.last_mut().unwrap_unchecked() = 0 };
> +            *buf.last_mut().ok_or(EINVAL)? = 0;

I am not sure this gives us much - we are trading an unsafe statement
that is well-controlled (enforced by the first two lines of the method)
for a runtime check. I'd say this is working as intended here.