Skip to content

Commit 83b08cb

Browse files
pthariensflameBennoLossin
authored andcommitted
remove impl Zeroable for Infallible
In Rust, producing an invalid value of any type is immediate undefined behavior (UB); this includes via zeroing memory. Therefore, since an uninhabited type has no valid values, producing any values at all for it is UB. The Rust standard library type `core::convert::Infallible` is uninhabited, by virtue of having been declared as an enum with no cases, which always produces uninhabited types in Rust. The current kernel code allows this UB to be triggered, for example by code like `Box::<core::convert::Infallible>::init(kernel::init::zeroed())`. Thus, remove the implementation of `Zeroable` for `Infallible`, thereby avoiding the unsoundness (potential for future UB).
1 parent 5f0747e commit 83b08cb

1 file changed

Lines changed: 9 additions & 2 deletions

File tree

src/lib.rs

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1481,8 +1481,15 @@ impl_zeroable! {
14811481
i8, i16, i32, i64, i128, isize,
14821482
f32, f64,
14831483

1484-
// SAFETY: These are ZSTs, there is nothing to zero.
1485-
{<T: ?Sized>} PhantomData<T>, core::marker::PhantomPinned, Infallible, (),
1484+
// Note: do not add uninhabited types (such as `!` or `core::convert::Infallible`) to this list;
1485+
// creating an instance of an uninhabited type is immediate undefined behavior. For more on
1486+
// uninhabited/empty types, consult The Rustonomicon:
1487+
// <https://doc.rust-lang.org/stable/nomicon/exotic-sizes.html#empty-types>. The Rust Reference
1488+
// also has information on undefined behavior:
1489+
// <https://doc.rust-lang.org/stable/reference/behavior-considered-undefined.html>.
1490+
//
1491+
// SAFETY: These are inhabited ZSTs; there is nothing to zero and a valid value exists.
1492+
{<T: ?Sized>} PhantomData<T>, core::marker::PhantomPinned, (),
14861493

14871494
// SAFETY: Type is allowed to take any value, including all zeros.
14881495
{<T>} MaybeUninit<T>,

0 commit comments

Comments
 (0)