On Mar 18, 2024, at 10:25 AM, Boqun Feng boqun.feng@gmail.com wrote:
On Wed, Mar 13, 2024 at 11:09:37PM +0000, Benno Lossin wrote:
From: Laine Taffin Altman alexanderaltman@me.com
It is not enough for a type to be a ZST to guarantee that zeroed memory is a valid value for it; it must also be inhabited. Creating a value of an uninhabited type, ZST or no, is immediate UB. Thus remove the implementation of `Zeroable` for `Infallible`, since that type is not inhabited.
Cc: stable@vger.kernel.org Fixes: 38cde0bd7b67 ("rust: init: add `Zeroable` trait and `init::zeroed` function") Closes: https://github.com/Rust-for-Linux/pinned-init/pull/13 Signed-off-by: Laine Taffin Altman alexanderaltman@me.com Signed-off-by: Benno Lossin benno.lossin@proton.me
I think either in the commit log or in the code comment, there better be a link or explanation on "(un)inhabited type". The rest looks good to me.
Would the following be okay for that purpose?
A type is inhabited if at least one valid value of that type exists; a type is uninhabited if no valid values of that type exist. The terms "inhabited" and "uninhabited" in this sense originate in type theory, a branch of mathematics.
In Rust, producing an invalid value of any type is immediate undefined behavior (UB); this includes via zeroing memory. Therefore, since an uninhabited type has no valid values, producing any values at all for it is UB.
The Rust standard library type `core::convert::Infallible` is uninhabited, by virtue of having been declared as an enum with no cases, which always produces uninhabited types in Rust. Thus, remove the implementation of `Zeroable` for `Infallible`, thereby avoiding the UB.
Thanks, Laine
Reviewed-by: Boqun Feng boqun.feng@gmail.com
Regards, Boqun
rust/kernel/init.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/rust/kernel/init.rs b/rust/kernel/init.rs index 424257284d16..538e03cfc84a 100644 --- a/rust/kernel/init.rs +++ b/rust/kernel/init.rs @@ -1292,8 +1292,8 @@ macro_rules! impl_zeroable { i8, i16, i32, i64, i128, isize, f32, f64,
- // SAFETY: These are ZSTs, there is nothing to zero.
- {<T: ?Sized>} PhantomData<T>, core::marker::PhantomPinned, Infallible, (),
// SAFETY: These are inhabited ZSTs, there is nothing to zero and a valid value exists.
{<T: ?Sized>} PhantomData<T>, core::marker::PhantomPinned, (),
// SAFETY: Type is allowed to take any value, including all zeros. {<T>} MaybeUninit<T>,
base-commit: 768409cff6cc89fe1194da880537a09857b6e4db
2.42.0