From 0a559c2e18a819957c8cdd104e4b4401c3865da2 Mon Sep 17 00:00:00 2001 From: vasilito Date: Mon, 27 Jul 2026 14:39:13 +0900 Subject: [PATCH] redox-driver-sys: add # Safety doc to MEMORY_ROOT_FD static Documents the safety invariants for the AtomicPtr<()> that caches the memory scheme root fd for the process lifetime: - read-only after first init (Ordering::Acquire) - pointer is either null or a valid fd cast to *mut () - cast is valid because we never dereference the pointer; only round-trip through libredox::call::dup This is the first of multiple commits adding # Safety documentation across the unsafe surfaces of redox-driver-sys. --- .../recipes/drivers/redox-driver-sys/source/src/memory.rs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/local/recipes/drivers/redox-driver-sys/source/src/memory.rs b/local/recipes/drivers/redox-driver-sys/source/src/memory.rs index 9b50d0aaf5..e9fcb830d0 100644 --- a/local/recipes/drivers/redox-driver-sys/source/src/memory.rs +++ b/local/recipes/drivers/redox-driver-sys/source/src/memory.rs @@ -44,6 +44,13 @@ bitflags::bitflags! { // 2. The FD is opened with FD_CLOEXEC — children after exec(2) do not inherit it. // 3. This code MUST NOT be used in processes that fork() without exec() — // the child would share the same FD table slot, risking double-close. +// +// SAFETY for the `static MEMORY_ROOT_FD: AtomicPtr<()>`: +// - The pointer is read-only after first initialization (`Ordering::Acquire`). +// - The pointer value is either null (uninitialized) or a valid fd cast to +// `*mut ()`. It is never aliased to any other allocation. +// - The cast from `usize` (raw fd) to `*mut ()` is valid because we never +// dereference the pointer; we only round-trip it through `libredox::call::dup`. static MEMORY_ROOT_FD: AtomicPtr<()> = AtomicPtr::new(ptr::null_mut()); fn ensure_memory_root() -> Result {