Re: [PATCH proxmox-backup v2 06/10] tape: tape block: represent tape block header with its own struct

["Max R. Carrara" <m.carrara@proxmox.com>]

On Wed Sep 2, 2026 at 6:17 PM CEST, Robert Obkircher wrote:
> > Both the `BlockedReader<R>` and `BlockedWriter<W>` structs use private
> > helpers that cast their `TapeBlock` to a (mutable) byte slice using an
> > `unsafe` block for reading and writing a tape block, respectively.
> >
> > Neither `unsafe` block is prefixed with a "// SAFETY: ..." comment,
> > nor should these casts be done inline in the first place.
> >
> > Instead, implement these casts as methods on `TapeBlock` directly,
> > with either `unsafe` block being preceded with a SAFETY comment.
> >
> > Signed-off-by: Max R. Carrara <m.carrara@proxmox.com>
> >
> > diff --git a/pbs-tape/src/blocked_reader.rs b/pbs-tape/src/blocked_reader.rs
> > index 6b1e3c692..6f5f87aa7 100644
> > --- a/pbs-tape/src/blocked_reader.rs
> > +++ b/pbs-tape/src/blocked_reader.rs
> > @@ -95,14 +95,7 @@ impl<R: BlockRead> BlockedReader<R> {
> >      }
> >
> >      fn read_block_frame(tape_block: &mut TapeBlock, reader: &mut R) -> Result<(), BlockReadError> {
> > -        let data = unsafe {
> > -            std::slice::from_raw_parts_mut(
> > -                (tape_block as *mut TapeBlock) as *mut u8,
> > -                TapeBlock::SIZE,
> > -            )
> > -        };
> > -
> > -        let bytes = reader.read_block(data)?;
> > +        let bytes = reader.read_block(tape_block.as_bytes_mut())?;
> >
> >          if bytes != TapeBlock::SIZE {
> >              return Err(proxmox_lang::io_format_err!("got wrong block size").into());
> > diff --git a/pbs-tape/src/blocked_writer.rs b/pbs-tape/src/blocked_writer.rs
> > index 0d5d10147..44ff15ae0 100644
> > --- a/pbs-tape/src/blocked_writer.rs
> > +++ b/pbs-tape/src/blocked_writer.rs
> > @@ -46,13 +46,7 @@ impl<W: BlockWrite> BlockedWriter<W> {
> >      }
> >
> >      fn write_block(tape_block: &TapeBlock, writer: &mut W) -> Result<bool, std::io::Error> {
> > -        let data = unsafe {
> > -            std::slice::from_raw_parts(
> > -                (tape_block as *const TapeBlock) as *const u8,
> > -                TapeBlock::SIZE,
> > -            )
> > -        };
> > -        writer.write_block(data)
> > +        writer.write_block(tape_block.as_bytes())
> >      }
> >
> >      fn write_eof(&mut self) -> Result<(), std::io::Error> {
> > diff --git a/pbs-tape/src/tape_block.rs b/pbs-tape/src/tape_block.rs
> > index c73efafa7..c6ff98395 100644
> > --- a/pbs-tape/src/tape_block.rs
> > +++ b/pbs-tape/src/tape_block.rs
> > @@ -117,4 +117,35 @@ impl TapeBlock {
> >      pub fn payload_mut(&mut self) -> &mut [u8] {
> >          &mut self.payload
> >      }
> > +
> > +    /// Returns the entirety of the tape block, meaning both its header and data
> > +    /// payload, as a byte slice.
> > +    pub fn as_bytes(&self) -> &[u8] {
> > +        // SAFETY:
> > +        // - Since `self` is a reference, we can convert it to a pointer without
> > +        //   any concerns. The resulting pointer is always valid and non-null.
> This point doesn't seem worth mentioning, especially if you leave out
> the more important ones like the fact that the struct doesn't contain
> any (uninitialized) padding bytes or interior mutability.

Good point, will add in v2. Thanks!

> > +        // - The pointer used here is not used or aliased anywhere else.
> This is neither true nor relevant. e.g. if you call as_bytes twice it
> will be aliased.

Right, but I was referring to the pointer that is `self as *const _` (or
`self as *mut _`) -- that pointer specifically is not aliased anywhere
else, meaning that the returned references are always valid and respect
Rust's ownership model.

All that being said, I should probably rephrase this to be more precise.
Thanks a lot, will fix in v2!

> > +        // - We allocated `*self` with a total size of `Self::SIZE` earlier,
> > +        //   meaning that the resulting slice never goes out of bounds.
> Relying on the fact that no other constructor exists seems like a bad
> idea. Just use `size_of_val(self)`.

Good point actually, since we just return a byte slice. Didn't think of
that. Will fix in v2, thanks!

> > +        // - The resulting slice never outlives `self`.
> > +        unsafe { std::slice::from_raw_parts((self as *const _) as *const u8, Self::SIZE) }
> I'd prefer `ptr::from_ref(self).cast()` to avoid the _

ACK, will fix in v2. Thanks!