From 56d9ad6f7d2f9e8c87fbc9d438f661570440f4ce Mon Sep 17 00:00:00 2001 From: vasilito Date: Mon, 27 Jul 2026 14:44:50 +0900 Subject: [PATCH] redox-driver-sys: add # Safety doc to pcid_client.rs from_raw_fd Documents the safety contract: the fd is freshly opened by either connect() or connect_by_path() and ownership transfers exactly once to the File. --- .../drivers/redox-driver-sys/source/src/pcid_client.rs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/local/recipes/drivers/redox-driver-sys/source/src/pcid_client.rs b/local/recipes/drivers/redox-driver-sys/source/src/pcid_client.rs index 7b6e8103e5..a0187572a1 100644 --- a/local/recipes/drivers/redox-driver-sys/source/src/pcid_client.rs +++ b/local/recipes/drivers/redox-driver-sys/source/src/pcid_client.rs @@ -97,6 +97,11 @@ impl PcidClient { } fn connect_common(channel_fd: RawFd) -> Self { + // SAFETY: `from_raw_fd` is unsafe because the caller must guarantee that + // `channel_fd` is a valid open file descriptor not aliased by any other + // owned File. The two callers (`connect` and `connect_by_path`) both open + // a fresh fd via `libredox::call::open`/`openat` and pass it through + // here exactly once, transferring ownership to the returned File. let channel = unsafe { File::from_raw_fd(channel_fd) }; Self { channel } }