Re: [PATCH v2 01/16] rust: io: add static `cast()` method for views

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Soundness hole: `KnownSize` is an unsealed safe trait, but its constants and methods are relied upon for memory safety in unsafe projections.
--

--- Patch [1]: [PATCH v2 01/16] rust: io: add static `cast()` method for views ---
commit 5783172643ee35d4a1864537f0c76cc527b2cad9
Author: Gary Guo <[email protected]>

rust: io: add static `cast()` method for views

This commit adds a compile-time checked cast() method for I/O views in the
Rust subsystem. It uses minimum size and alignment information to statically
verify that the target type is of the same or smaller size and properly
aligned, allowing conversion without runtime checks.

> diff --git a/rust/kernel/io.rs b/rust/kernel/io.rs
> index a38c20ba3d23e..adfc555de7d0d 100644
> --- a/rust/kernel/io.rs
> +++ b/rust/kernel/io.rs

[ ... ]

> +    #[inline]
> +    fn cast<U>(self) -> <Self::Backend as IoBackend>::View<'a, U>
> +    where
> +        Self::Target: FromBytes + IntoBytes,
> +        U: FromBytes + IntoBytes,
> +    {
> +        let view = self.as_view();
> +        let ptr = Self::Backend::as_ptr(view);
> +
> +        const_assert!(size_of::<U>() <= Self::Target::MIN_SIZE);
> +        const_assert!(align_of::<U>() <= Self::Target::MIN_ALIGN.as_usize());
> +
> +        // SAFETY: We have checked bounds and alignment, so this is a valid projection.
> +        unsafe { Self::Backend::project_view(view, ptr.cast()) }
           ^^^^^^

[Severity: High]
This is a pre-existing issue, but does relying on KnownSize constants for
memory safety create a soundness hole?

KnownSize is an unsealed safe trait that provides the constants and methods
relied upon for these safety guarantees. Because it is a safe trait, safe
code could provide an incorrect implementation for a custom dynamically sized
type (DST), specifying an excessively large MIN_SIZE or size().

If this happens, the bounds checks in cast() or try_cast() would pass based
on bogus values from the safe trait. The unsafe project_view() projection
would then proceed, potentially creating an out-of-bounds pointer projection
and leading to memory corruption.

Since implementing a safe trait shouldn't be able to trigger undefined
behavior in safe code, should KnownSize be marked unsafe or sealed to prevent
unsound implementations?

> +    }
> +
>      /// Try to convert into a different typed I/O view.
>      ///
>      /// A runtime check is performed to ensure that the target type is of same or smaller size to

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1