rust: kernel: add missing safety documentation

This series adds missing // SAFETY: comments to unsafe blocks in the Rust kernel abstractions, replacing existing TODOs.

This aligns the code with the project's requirement that all unsafe blocks must be documented with a safety rationale.

Navaneeth K (2):
rust: kernel: document safety for rust_fmt_argument
rust: kernel: document safety for as_str_unchecked

 rust/kernel/print.rs | 2 +-
 rust/kernel/str.rs   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

2.43.0

Add a proper // SAFETY: comment for the unsafe pointer dereference in rust_fmt_argument. The comment explains that the caller guarantees the pointer validity, satisfying the Rust-for-Linux safety documentation requirements.

---
 rust/kernel/print.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 2d743d78d220..49fa87dfbce8 100644
@@ -24,7 +24,7 @@
     use fmt::Write;
     // SAFETY: The C contract guarantees that `buf` is valid if it's less than `end`.
     let mut w = unsafe { RawFormatter::from_ptrs(buf.cast(), end.cast()) };
-    // SAFETY: TODO.
+    // SAFETY: The caller guarantees that `ptr` points to a valid `fmt::Arguments`.
     let _ = w.write_fmt(unsafe { *ptr.cast::<fmt::Arguments<'_>>() });
     w.pos().cast()
 }

2.43.0

Thanks for the patch!

The caller is indeed supposed to pass a proper ptr, but we should actually require it, i.e. this line above:

#[expect(clippy::missing_safety_doc)]

should be replaced with docs with a # Safety section that requires it so that then we can apply the guarantee as you did in the // SAFETY: doc.

Also, in addition to that parameter, we should double-check we put enough safety preconditions on the other parameters. If we do that, then we could also update the "C contract guarantees" safety comment too to just refer to those.

(We could perhaps even mention in the C header that the safety preconditions are written in the Rust docs for completeness.)

Cheers,
Miguel

Replace the TODO safety comment with a proper explanation. The safety of from_utf8_unchecked relies on the caller guaranteeing that the input bytes are valid UTF-8.

---
 rust/kernel/str.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 5c74e5f77601..2801388c6bd1 100644
@@ -385,7 +385,7 @@ pub fn to_str(&self) -> Result<&str, core::str::Utf8Error> {
     /// ```
     #[inline]
     pub unsafe fn as_str_unchecked(&self) -> &str {
-        // SAFETY: TODO.
+        // SAFETY: The caller guarantees that the contents are valid UTF-8.
         unsafe { core::str::from_utf8_unchecked(self.as_bytes()) }
     }
 

2.43.0