-
Notifications
You must be signed in to change notification settings - Fork 182
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Mark __getrandom_custom unsafe #341
Conversation
Looks good.
Hm, we may want to use |
This supersedes #341, and makes the following changes - All the code for implementing `__getrandom_custom` is now in an unnamed `const` block (stable since 1.37) - I found this approch [here](https://internals.rust-lang.org/t/anonymous-modules/15441) - Nothing inside the block can be referenced outside of it - `__getrandom_custom` is marked `unsafe` - It can't be accessed externally, but is "logically" unsafe as it dereferences raw pointers - The type of the function is moved to a typedef, so we can check that the defined type matches that of `getrandom:getrandom`. - Use `::core::result::Result` instead of `Result` - Similar to use use of `from_raw_parts_mut` this prevents compilation errors if `Result` is redefined. Signed-off-by: Joe Richey <[email protected]>
@newpavlov @LegionMammal978 I opened #344 which overhauls the custom implementation macro and includes these changes. Specifically, the implementation is now inaccessible, so external users cannot use it at all, regardless of if it is @newpavlov if #344 looks good to you, approve it and close this PR. |
The calling ABI questions are more complicated, I opened #345 to just track the ABI stuff. |
This supersedes #341, and makes the following changes - All the code for implementing `__getrandom_custom` is now in an **named** `const` block (unnamed consts require Rust 1.37) - I found this approch [here](https://internals.rust-lang.org/t/anonymous-modules/15441) - Nothing inside the block can be referenced outside of it - `__getrandom_custom` is marked `unsafe` - It can't be accessed externally, but is "logically" unsafe as it dereferences raw pointers - The type of the function is moved to a typedef, so we can check that the defined type matches that of `getrandom:getrandom`. - Use `::core::result::Result` instead of `Result` - Similar to use use of `from_raw_parts_mut` this prevents compilation errors if `Result` is redefined. Signed-off-by: Joe Richey <[email protected]>
This supersedes #341, and makes the following changes - All the code for implementing `__getrandom_custom` is now in an **named** `const` block (unnamed consts require Rust 1.37) - I found this approch [here](https://internals.rust-lang.org/t/anonymous-modules/15441) - Nothing inside the block can be referenced outside of it - `__getrandom_custom` is marked `unsafe` - It can't be accessed externally, but is "logically" unsafe as it dereferences raw pointers - The type of the function is moved to a typedef, so we can check that the defined type matches that of `getrandom:getrandom`. - Use `::core::result::Result` instead of `Result` - Similar to use use of `from_raw_parts_mut` this prevents compilation errors if `Result` is redefined. Signed-off-by: Joe Richey <[email protected]>
This supersedes #341, and makes the following changes - All the code for implementing `__getrandom_custom` is now in an **named** `const` block (unnamed consts require Rust 1.37) - I found this approch [here](https://internals.rust-lang.org/t/anonymous-modules/15441) - Nothing inside the block can be referenced outside of it - `__getrandom_custom` is marked `unsafe` - It can't be accessed externally, but is "logically" unsafe as it dereferences raw pointers - The type of the function is moved to a typedef, so we can check that the defined type matches that of `getrandom:getrandom`. - Use `::core::result::Result` instead of `Result` - Similar to use use of `from_raw_parts_mut` this prevents compilation errors if `Result` is redefined. Signed-off-by: Joe Richey <[email protected]>
This supersedes #341, and makes the following changes - All the code for implementing `__getrandom_custom` is now in an **named** `const` block (unnamed consts require Rust 1.37) - I found this approch [here](https://internals.rust-lang.org/t/anonymous-modules/15441) - Nothing inside the block can be referenced outside of it - `__getrandom_custom` is marked `unsafe` - It can't be accessed externally, but is "logically" unsafe as it dereferences raw pointers - The type of the function is moved to a typedef, so we can check that the defined type matches that of `getrandom:getrandom`. - Use `::core::result::Result` instead of `Result` - Similar to use use of `from_raw_parts_mut` this prevents compilation errors if `Result` is redefined. Signed-off-by: Joe Richey <[email protected]>
Closing in favor of #344 |
Right now, the lack of documentation is the only thing stopping callers from directly calling
__getrandom_custom()
from safe code:Marking the function
unsafe
should discourage this.(Also, note that it is currently formally considered UB if an
extern "C"
function unwinds after a panic, and there is nothing in__getrandom_custom()
to prevent the callback from unwinding through it. However, the Rust project has plans to automatically add an unwind-to-abort shim toextern "C"
functions (rust-lang/rust#74990), so waiting for that may be simpler than addingcatch_unwind()
or a drop guard.)