From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 376CC1FF0AA for ; Tue, 03 Nov 2026 12:31:47 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 09DF9218CA; Tue, 03 Nov 2026 12:31:47 +0100 (CET) From: Robert Obkircher To: pbs-devel@lists.proxmox.com Subject: [PATCH v1 proxmox-backup 5/8] tree-wide: mark extern blocks as unsafe and add some safety comments Date: Tue, 3 Nov 2026 12:28:41 +0100 Message-ID: <20261103113054.184327-6-r.obkircher@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261103113054.184327-1-r.obkircher@proxmox.com> References: <20261103113054.184327-1-r.obkircher@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793705499496 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.494 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: ZLZD26TUGVORMV7KHMS7AJ44R6WD3TLY X-Message-ID-Hash: ZLZD26TUGVORMV7KHMS7AJ44R6WD3TLY X-MailFrom: r.obkircher@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Add the unsafe keyword, because it will be required in the 2024 edition. It has been accepted since rust 1.82. Also add some safety comments, and adjust the constness of a pointer to better match the C header. No functional change intended. Signed-off-by: Robert Obkircher --- pbs-tape/src/sgutils2.rs | 19 ++++++++++++++++--- pbs-tools/src/cert.rs | 6 +++++- 2 files changed, 21 insertions(+), 4 deletions(-) diff --git a/pbs-tape/src/sgutils2.rs b/pbs-tape/src/sgutils2.rs index 908d50b2f..363383aea 100644 --- a/pbs-tape/src/sgutils2.rs +++ b/pbs-tape/src/sgutils2.rs @@ -363,8 +363,11 @@ pub const SCSI_PT_RESULT_SENSE: c_int = 2; pub const SCSI_PT_RESULT_TRANSPORT_ERR: c_int = 3; pub const SCSI_PT_RESULT_OS_ERR: c_int = 4; +// SAFETY: +// * We link against libsgutils2 because of the link attribute. +// * The signatures match the C definitions in /usr/include/scsi/{sg_lib,sg_pt}.h #[link(name = "sgutils2")] -extern "C" { +unsafe extern "C" { #[allow(dead_code)] fn scsi_pt_open_device(device_name: *const c_char, read_only: bool, verbose: c_int) -> c_int; @@ -398,8 +401,8 @@ extern "C" { asc: c_int, ascq: c_int, buff_len: c_int, - buffer: *mut c_char, - ) -> *const c_char; + buff: *mut c_char, + ) -> *mut c_char; } /// Safe interface to run RAW SCSI commands @@ -413,6 +416,10 @@ pub struct SgRaw<'a, F> { /// Get the string associated with ASC/ASCQ values pub fn get_asc_ascq_string(asc: u8, ascq: u8) -> String { let mut buffer = [0u8; 1024]; + // SAFETY: + // * asc and ascq are within the expected u8 range + // * The length fits into c_int without overflow. + // * as_mut_ptr returns writable memory of the corresponding length. let res = unsafe { sg_get_asc_ascq_str( asc as c_int, @@ -427,6 +434,12 @@ pub fn get_asc_ascq_string(asc: u8, ascq: u8) -> String { // just to be safe bail!("unexpected NULL ptr"); } + // SAFETY: + // * sg_get_asc_ascq_str wrote a zero terminated string into buffer. + // * It returns the pointer to the start of the buffer, which is not + // null, and valid for reads, because it hasn't been invalidated + // by another use of buffer. + // * buffer outlives the created CStr Ok(unsafe { CStr::from_ptr(res) }.to_str()?.to_owned()) }) .unwrap_or_else(|_err: Error| format!("ASC={asc:02x}x, ASCQ={ascq:02x}x")) diff --git a/pbs-tools/src/cert.rs b/pbs-tools/src/cert.rs index 61ccce952..2a8dea6e5 100644 --- a/pbs-tools/src/cert.rs +++ b/pbs-tools/src/cert.rs @@ -13,7 +13,11 @@ use openssl::x509::{GeneralName, X509}; #[allow(non_camel_case_types)] type ASN1_TIME = ::CType; -extern "C" { +// SAFETY: +// * The function signature matches the openssl C API. +// * The symbol is guaranteed to be available because the openssl +// crate links against the native library. +unsafe extern "C" { fn ASN1_TIME_to_tm(s: *const ASN1_TIME, tm: *mut libc::tm) -> libc::c_int; } -- 2.47.3