Re: [RFC PATCH v1 5/5] rust: file: add `DeferredFdCloser`

[Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>]

Hi Alice,

A quick comment on referencing commits:

On Thu, Jul 20, 2023 at 5:29 PM Alice Ryhl <aliceryhl@google.com> wrote:
>
> See comments on `binder_do_fd_close` and commit `80cd795630d65` for
> motivation.

The convention is to write these commit references like this:

    commit 80cd795630d6 ("binder: fix use-after-free due to
ksys_close() during fdget()")

I recommend generating them with a Git pretty format -- see the config
in the bottom part of the section at
https://docs.kernel.org/process/submitting-patches.html#describe-your-changes.

Also, given it is a kernel convention, please avoid the Markdown
backticks in this case.

> +/// See comments on `binder_do_fd_close` and commit `80cd795630d65`.

Same here, i.e. in comments and documentation too (and emails too,
especially if not referenced elsewhere).

While I am at it, a few other notes below too I noticed:

> +    /// Create a new `DeferredFdCloser`.

[`DeferredFdCloser`]

> +    /// Schedule a task work that closes the file descriptor when this task returns to userspace.
> +    pub fn close_fd(mut self, fd: u32) {
> +        let file = unsafe { bindings::close_fd_get_file(fd) };
> +        if !file.is_null() {

Please use the early return style here, if possible, to unindent all this.

> +            // SAFETY: Since DeferredFdCloserInner is `#[repr(C)]`, casting the pointers gives a

`DeferredFdCloserInner`

> +            // Note: fl_owner_t is currently a void pointer.

`fl_owner_t`

> +            // SAFETY: The `inner` pointer is compatible with the `do_close_fd` method.
> +            //
> +            // The call to `task_work_add` can't fail, because we are scheduling the task work to
> +            // the current task.
> +            unsafe {
> +                bindings::init_task_work(inner, Some(Self::do_close_fd));
> +                bindings::task_work_add(current, inner, bindings::task_work_notify_mode_TWA_RESUME);
> +            }

Should this block be split?

>  /// Represents the EBADF error code.
>  ///
>  /// Used for methods that can only fail with EBADF.

Doclink them if possible; otherwise `EBADF`.

Cheers,
Miguel