Re: [PATCH] rust: sync: fix safety comment for `Arc::from_raw`

[Gary Guo]

On Wed Sep 23, 2026 at 7:32 PM BST, Andreas Hindborg wrote:
> `Arc::from_raw` does not require `T: Send`. But if `Arc::from_raw` was
> executed on a different thread than `Arc::into_raw`, `T` must implement
> `Send` for the API to be sound. If this is not the case, ownership of `T`
> may be sent across a thread boundary even if `T: !Send`.
>
> Augment safety comment for `Arc::from_raw` to close this gap.
>
> Signed-off-by: Andreas Hindborg <a.hindborg@xxxxxxxxxx>
> ---
>  rust/kernel/sync/arc.rs | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/rust/kernel/sync/arc.rs b/rust/kernel/sync/arc.rs
> index 8ae0fe6f19ec..06838ecf633c 100644
> --- a/rust/kernel/sync/arc.rs
> +++ b/rust/kernel/sync/arc.rs
> @@ -276,6 +276,9 @@ pub fn as_ptr(this: &Self) -> *const T {
>      ///
>      /// `ptr` must have been returned by a previous call to [`Arc::into_raw`]. Additionally, it
>      /// must not be called more than once for each previous call to [`Arc::into_raw`].
> +    ///
> +    /// If [`Arc::into_raw`] was executed on a different thread than the one executing
> +    /// [`Arc::from_raw`], `T` must implement [`Send`].

This needs to be `Send + Sync`?

That said, I am not sure if we want to enumerate all cases where things can go
wrong. For example, would `Box::from_raw` need to mention that the type is
`Send` too? `ARef::from_raw`? `ForeignOwnable::from_foreign/borrow/borrow_mut`
all have to mention about this, too?

Best,
Gary

>      pub unsafe fn from_raw(ptr: *const T) -> Self {
>          // SAFETY: The caller promises that this pointer originates from a call to `into_raw` on an
>          // `Arc` that is still valid.
>
> ---
> base-commit: df2908090cda368b01ff43709f51890076c56157
> change-id: 20260923-aref-from-raw-safety-78a7283627fa
>
> Best regards,
> --  
> Andreas Hindborg <a.hindborg@xxxxxxxxxx>