Re: [PATCH proxmox-backup v2 06/10] tape: tape block: represent tape block header with its own struct

[Robert Obkircher <r.obkircher@proxmox.com>]

> Both the `BlockedReader<R>` and `BlockedWriter<W>` structs use private
> helpers that cast their `TapeBlock` to a (mutable) byte slice using an
> `unsafe` block for reading and writing a tape block, respectively.
> 
> Neither `unsafe` block is prefixed with a "// SAFETY: ..." comment,
> nor should these casts be done inline in the first place.
> 
> Instead, implement these casts as methods on `TapeBlock` directly,
> with either `unsafe` block being preceded with a SAFETY comment.
> 
> Signed-off-by: Max R. Carrara <m.carrara@proxmox.com>
>
> diff --git a/pbs-tape/src/blocked_reader.rs b/pbs-tape/src/blocked_reader.rs
> index 6b1e3c692..6f5f87aa7 100644
> --- a/pbs-tape/src/blocked_reader.rs
> +++ b/pbs-tape/src/blocked_reader.rs
> @@ -95,14 +95,7 @@ impl<R: BlockRead> BlockedReader<R> {
>      }
>  
>      fn read_block_frame(tape_block: &mut TapeBlock, reader: &mut R) -> Result<(), BlockReadError> {
> -        let data = unsafe {
> -            std::slice::from_raw_parts_mut(
> -                (tape_block as *mut TapeBlock) as *mut u8,
> -                TapeBlock::SIZE,
> -            )
> -        };
> -
> -        let bytes = reader.read_block(data)?;
> +        let bytes = reader.read_block(tape_block.as_bytes_mut())?;
>  
>          if bytes != TapeBlock::SIZE {
>              return Err(proxmox_lang::io_format_err!("got wrong block size").into());
> diff --git a/pbs-tape/src/blocked_writer.rs b/pbs-tape/src/blocked_writer.rs
> index 0d5d10147..44ff15ae0 100644
> --- a/pbs-tape/src/blocked_writer.rs
> +++ b/pbs-tape/src/blocked_writer.rs
> @@ -46,13 +46,7 @@ impl<W: BlockWrite> BlockedWriter<W> {
>      }
>  
>      fn write_block(tape_block: &TapeBlock, writer: &mut W) -> Result<bool, std::io::Error> {
> -        let data = unsafe {
> -            std::slice::from_raw_parts(
> -                (tape_block as *const TapeBlock) as *const u8,
> -                TapeBlock::SIZE,
> -            )
> -        };
> -        writer.write_block(data)
> +        writer.write_block(tape_block.as_bytes())
>      }
>  
>      fn write_eof(&mut self) -> Result<(), std::io::Error> {
> diff --git a/pbs-tape/src/tape_block.rs b/pbs-tape/src/tape_block.rs
> index c73efafa7..c6ff98395 100644
> --- a/pbs-tape/src/tape_block.rs
> +++ b/pbs-tape/src/tape_block.rs
> @@ -117,4 +117,35 @@ impl TapeBlock {
>      pub fn payload_mut(&mut self) -> &mut [u8] {
>          &mut self.payload
>      }
> +
> +    /// Returns the entirety of the tape block, meaning both its header and data
> +    /// payload, as a byte slice.
> +    pub fn as_bytes(&self) -> &[u8] {
> +        // SAFETY:
> +        // - Since `self` is a reference, we can convert it to a pointer without
> +        //   any concerns. The resulting pointer is always valid and non-null.
This point doesn't seem worth mentioning, especially if you leave out
the more important ones like the fact that the struct doesn't contain
any (uninitialized) padding bytes or interior mutability.
> +        // - The pointer used here is not used or aliased anywhere else.
This is neither true nor relevant. e.g. if you call as_bytes twice it
will be aliased.
> +        // - We allocated `*self` with a total size of `Self::SIZE` earlier,
> +        //   meaning that the resulting slice never goes out of bounds.
Relying on the fact that no other constructor exists seems like a bad
idea. Just use `size_of_val(self)`.
> +        // - The resulting slice never outlives `self`.
> +        unsafe { std::slice::from_raw_parts((self as *const _) as *const u8, Self::SIZE) }
I'd prefer `ptr::from_ref(self).cast()` to avoid the _

-- 
Robert Obkircher <r.obkircher@proxmox.com>