cqwrteur (euloanty.delete@this.live.com) on July 9, 2021 9:56 pm wrote:
> I just read the upcoming Rust code for Linux Kernel from Github. Maybe I am stupid.
> What I see is just unsafe everywhere. All Rust functions are unsafe.

That crate - alloc - is part of the standard library that's being ported to the Linux kernel in order to be used. Since it implements allocators, collections, smart/refcount pointers and such, a small part of it requires the use of the unsafe keyword. This is low-level plumbing, it doesn't get any lower level than this in Rust. If you have a more thorough look you'll notice that the unsafe sections are surprisingly few compared to the overall size of this particular piece of the std library. It also makes sense that you'll find all of them here, because that's how you encapsulate unsafe usage in a way that presents safe semantics to the outside world.

Last but not least this code - being ported from the standard library - is used in thousands of different projects which makes it pretty well tested. To put a hard number on that 11 CVEs were filed this year against Rust's standard library. 3 of them affect only very old versions of it, 2 affect old-but-not-very-old versions and 3 more can only happen during panics which I doubt will be allowed in the kernel. That leaves only 3 CVEs that affected the current version and did not involve panics; not bad for a library that's several times larger than your average C and C++ standard libraries combined and much younger.