Re: [PATCH v4] rust: num: restrict bool conversion to unsigned Bounded

["Alexandre Courbot" <acourbot@nvidia.com>]

On Mon Aug 24, 2026 at 8:32 PM JST, Miguel Ojeda wrote:
> On Sat, Aug 22, 2026 at 10:45 AM Younes Akhouayri via B4 Relay
> <devnull+git.younes.io@kernel.org> wrote:
>>
>> From: Younes Akhouayri <git@younes.io>
>>
>> From<bool> turns true into 1. A signed Bounded with N = 1 can hold
>> only -1 and 0. The current implementation can therefore create a value
>> that breaks Bounded's invariant. Deref relies on that invariant and
>> calls unreachable_unchecked() when it is broken, so safe Rust can reach
>> undefined behavior.
>>
>> The other primitive conversions require the source and destination to
>> have the same signedness. Treat bool as an unsigned one-bit value and
>> allow conversions between bool and Bounded only when the backing integer
>> type is unsigned.
>>
>> Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type")
>> Closes: https://lore.kernel.org/rust-for-linux/OzuVxu0--J-9@younes.io/
>> Cc: stable@vger.kernel.org
>> Suggested-by: Alexandre Courbot <acourbot@nvidia.com>
>> Assisted-by: Codex:gpt-5.6-sol
>> Signed-off-by: Younes Akhouayri <git@younes.io>
>
> Applied to `rust-fixes` -- thanks everyone!
>
> Reviewing this with an LLM made me notice that we should probably seal
> `Integer` or make it `unsafe`, because currently someone can
> buggily/maliciously implement it to still trigger UB regardless of
> this fix.

Good idea indeed. I'll send a patch to seal it, thanks for mentioning it!