Re: [PATCH proxmox-backup v2 06/10] tape: tape block: represent tape block header with its own struct

[Robert Obkircher <r.obkircher@proxmox.com>]

On 07.09.26 13:44, Max R. Carrara wrote:
> On Wed Sep 2, 2026 at 6:17 PM CEST, Robert Obkircher wrote:
>>> [..]
>>>
>>> +    /// Returns the entirety of the tape block, meaning both its header and data
>>> +    /// payload, as a byte slice.
>>> +    pub fn as_bytes(&self) -> &[u8] {
>>> +        // SAFETY:
>>> +        // - Since `self` is a reference, we can convert it to a pointer without
>>> +        //   any concerns. The resulting pointer is always valid and non-null.
>> This point doesn't seem worth mentioning, especially if you leave out
>> the more important ones like the fact that the struct doesn't contain
>> any (uninitialized) padding bytes or interior mutability.
> Good point, will add in v2. Thanks!
>
>>> +        // - The pointer used here is not used or aliased anywhere else.
>> This is neither true nor relevant. e.g. if you call as_bytes twice it
>> will be aliased.
> Right, but I was referring to the pointer that is `self as *const _` (or
> `self as *mut _`) -- that pointer specifically is not aliased anywhere
> else, meaning that the returned references are always valid and respect
> Rust's ownership model.
>
> All that being said, I should probably rephrase this to be more precise.
> Thanks a lot, will fix in v2!
I still don't understand what you mean by "not aliased".

For &mut self you can argue that you have exclusive access, but for
&self you have to assume that other references exist.

>>> +        // - We allocated `*self` with a total size of `Self::SIZE` earlier,
>>> +        //   meaning that the resulting slice never goes out of bounds.
>> Relying on the fact that no other constructor exists seems like a bad
>> idea. Just use `size_of_val(self)`.
> Good point actually, since we just return a byte slice. Didn't think of
> that. Will fix in v2, thanks!
>
>>> +        // - The resulting slice never outlives `self`.
>>> +        unsafe { std::slice::from_raw_parts((self as *const _) as *const u8, Self::SIZE) }
>> I'd prefer `ptr::from_ref(self).cast()` to avoid the _
> ACK, will fix in v2. Thanks!
>