Checking that we are not missing any `// SAFETY` comments in our `unsafe` blocks is something we have wanted to do for a long time, as well as cleaning up the remaining cases that were not documented [1]. Back when Rust for Linux started, this was something that could have been done via a script, like Rust's `tidy`. Soon after, in Rust 1.58.0, Clippy implemented the `undocumented_unsafe_blocks` lint [2]. Even though the lint has a few false positives, e.g. in some cases where attributes appear between the comment and the `unsafe` block [3], there are workarounds and the lint seems quite usable already. Thus enable the lint now. We still have a few cases to clean up, so just allow those for the moment by writing a `TODO` comment -- some of those may be good candidates for new contributors.
Showing the changes to rust/kernel/init (2 of 16 files). Show all
Unified · Split
| @@ -112,10 +112,12 @@ impl<T: ?Sized> Clone for AllData<T> { · 111 unmodified lines | ||
| 112 | 112 | |
| 113 | 113 | impl<T: ?Sized> Copy for AllData<T> {} |
| 114 | 114 | |
| 115 | +// SAFETY: TODO. | |
| 115 | 116 | unsafe impl<T: ?Sized> InitData for AllData<T> { |
| 116 | 117 | type Datee = T; |
| 117 | 118 | } |
| 118 | 119 | |
| 120 | +// SAFETY: TODO. | |
| 119 | 121 | unsafe impl<T: ?Sized> HasInitData for T { |
| 120 | 122 | type InitData = AllData<T>; |
| 121 | 123 | |
| @@ -513,6 +513,7 @@ macro_rules! __pinned_drop { · 512 unmodified lines | ||
| 513 | 513 | } |
| 514 | 514 | ), |
| 515 | 515 | ) => { |
| 516 | + // SAFETY: TODO. | |
| 516 | 517 | unsafe $($impl_sig)* { |
| 517 | 518 | // Inherit all attributes and the type/ident tokens for the signature. |
| 518 | 519 | $(#[$($attr)*])* |
| @@ -872,6 +873,7 @@ macro_rules! __pin_data { · 353 unmodified lines | ||
| 872 | 873 | } |
| 873 | 874 | } |
| 874 | 875 | |
| 876 | + // SAFETY: TODO. | |
| 875 | 877 | unsafe impl<$($impl_generics)*> |
| 876 | 878 | $crate::init::__internal::PinData for __ThePinData<$($ty_generics)*> |
| 877 | 879 | where $($whr)* |
| @@ -997,6 +999,7 @@ macro_rules! __pin_data { · 119 unmodified lines | ||
| 997 | 999 | slot: *mut $p_type, |
| 998 | 1000 | init: impl $crate::init::PinInit<$p_type, E>, |
| 999 | 1001 | ) -> ::core::result::Result<(), E> { |
| 1002 | + // SAFETY: TODO. | |
| 1000 | 1003 | unsafe { $crate::init::PinInit::__pinned_init(init, slot) } |
| 1001 | 1004 | } |
| 1002 | 1005 | )* |
| @@ -1007,6 +1010,7 @@ macro_rules! __pin_data { · 4 unmodified lines | ||
| 1007 | 1010 | slot: *mut $type, |
| 1008 | 1011 | init: impl $crate::init::Init<$type, E>, |
| 1009 | 1012 | ) -> ::core::result::Result<(), E> { |
| 1013 | + // SAFETY: TODO. | |
| 1010 | 1014 | unsafe { $crate::init::Init::__init(init, slot) } |
| 1011 | 1015 | } |
| 1012 | 1016 | )* |
| @@ -1121,6 +1125,8 @@ macro_rules! __init_internal { · 108 unmodified lines | ||
| 1121 | 1125 | // no possibility of returning without `unsafe`. |
| 1122 | 1126 | struct __InitOk; |
| 1123 | 1127 | // Get the data about fields from the supplied type. |
| 1128 | + // | |
| 1129 | + // SAFETY: TODO. | |
| 1124 | 1130 | let data = unsafe { |
| 1125 | 1131 | use $crate::init::__internal::$has_data; |
| 1126 | 1132 | // Here we abuse `paste!` to retokenize `$t`. Declarative macros have some internal |
| @@ -1176,6 +1182,7 @@ macro_rules! __init_internal { · 49 unmodified lines | ||
| 1176 | 1182 | let init = move |slot| -> ::core::result::Result<(), $err> { |
| 1177 | 1183 | init(slot).map(|__InitOk| ()) |
| 1178 | 1184 | }; |
| 1185 | + // SAFETY: TODO. | |
| 1179 | 1186 | let init = unsafe { $crate::init::$construct_closure::<_, $err>(init) }; |
| 1180 | 1187 | init |
| 1181 | 1188 | }}; |
| @@ -1324,6 +1331,8 @@ macro_rules! __init_internal { · 142 unmodified lines | ||
| 1324 | 1331 | // Endpoint, nothing more to munch, create the initializer. |
| 1325 | 1332 | // Since we are in the closure that is never called, this will never get executed. |
| 1326 | 1333 | // We abuse `slot` to get the correct type inference here: |
| 1334 | + // | |
| 1335 | + // SAFETY: TODO. | |
| 1327 | 1336 | unsafe { |
| 1328 | 1337 | // Here we abuse `paste!` to retokenize `$t`. Declarative macros have some internal |
| 1329 | 1338 | // information that is associated to already parsed fragments, so a path fragment |