3 ms·

> On the other hand, might the rumored sudden merge of the ksmdb driver (https://lwn.net/Articles/871098/ https://lwn.net/Articles/871098/) have been due to the

> On the other hand, might the rumored sudden merge of the ksmdb driver (https://lwn.net/Articles/871098/ https://lwn.net/Articles/871098/) have been due to the implicit threat of its being rewritten in Rust? That links to a message saying this: > "ksmbd was then merged unbeknownst to me and my worries confirmed to be true as some out-of-bounds bugs (which are impossible in Rust) surfaced immediately." Sad.

josefx 5y ago
I would like a link to the bugs in question. The only bugs I found have a long email chain with people being surprised that the kernel module even passed any tests at all, with extensive changes needed to fix logic issues for the path conversion code. The devs. even added an unload reload cycle to the tests because the module was in a bad enough state that it wouldn't consistently run over several iterations. I wouldn't be surprised if they would simply turn to unsafe if they had to write it in Rust, errors are apparently to be worked around not fixed. [1] [1]https://lore.kernel.org/lkml/CAH2r5mvu5wTcgoR-EeXLcoZOvhEiMR0Lfmwt6gd1J1wvtTLDHA@mail.gmail.com/T/#u https://lore.kernel.org/lkml/CAH2r5mvu5wTcgoR-EeXLcoZOvhEiMR... edit: the last part of my comment may be a bit over the top, but I think the quality issues at the language level are just the tip of the iceberg for this module.
- Measter 5y ago
  > I wouldn't be surprised if they would simply turn to unsafe if they had to write it in Rust, errors are apparently to be worked around not fixed. They probably would. But it's easier to find usages of unsafe through grep or the like than it is with C because Rust's syntax and requirement of marking unsafe make it easier to find. To use one of my own codebases for example, I can look at the instances of the following regex patterns: * "\bfn\b" (function declarations), 138 matches. * "\bunsafe\s+fn\b" or "\bunsafe\s+extern\b" (unsafe function declarations), 23 total. * "\bunsafe\s*\{" (opening an unsafe block), 41 matches. * "\bunsafe\s+impl" (unsafe trait implementation), 0 matches. We can also look at the total lines of code written (2269), and ask if this these numbers feel reasonable for what it's doing. Obviously that will require familiarity with Rust, what's being implemented, and the expected amount of unsafe based on previous usage in the kernel, but it would at least give an overall feel. And, of course, if you want to examine any of them, you know exactly where they are.
pdimitar 5y ago
Wait wait, so somebody panicked that something might be rewritten in Rust and they rushed to merge C code which was then proven to have memory safety bugs?! Is that what happened?

josefx 5y ago

I would like a link to the bugs in question. The only bugs I found have a long email chain with people being surprised that the kernel module even passed any tests at all, with extensive changes needed to fix logic issues for the path conversion code. The devs. even added an unload reload cycle to the tests because the module was in a bad enough state that it wouldn't consistently run over several iterations. I wouldn't be surprised if they would simply turn to unsafe if they had to write it in Rust, errors are apparently to be worked around not fixed. [1] [1]https://lore.kernel.org/lkml/CAH2r5mvu5wTcgoR-EeXLcoZOvhEiMR0Lfmwt6gd1J1wvtTLDHA@mail.gmail.com/T/#u https://lore.kernel.org/lkml/CAH2r5mvu5wTcgoR-EeXLcoZOvhEiMR... edit: the last part of my comment may be a bit over the top, but I think the quality issues at the language level are just the tip of the iceberg for this module.

Measter 5y ago
> I wouldn't be surprised if they would simply turn to unsafe if they had to write it in Rust, errors are apparently to be worked around not fixed. They probably would. But it's easier to find usages of unsafe through grep or the like than it is with C because Rust's syntax and requirement of marking unsafe make it easier to find. To use one of my own codebases for example, I can look at the instances of the following regex patterns: * "\bfn\b" (function declarations), 138 matches. * "\bunsafe\s+fn\b" or "\bunsafe\s+extern\b" (unsafe function declarations), 23 total. * "\bunsafe\s*\{" (opening an unsafe block), 41 matches. * "\bunsafe\s+impl" (unsafe trait implementation), 0 matches. We can also look at the total lines of code written (2269), and ask if this these numbers feel reasonable for what it's doing. Obviously that will require familiarity with Rust, what's being implemented, and the expected amount of unsafe based on previous usage in the kernel, but it would at least give an overall feel. And, of course, if you want to examine any of them, you know exactly where they are.

pdimitar 5y ago

Wait wait, so somebody panicked that something might be rewritten in Rust and they rushed to merge C code which was then proven to have memory safety bugs?! Is that what happened?