rust: make Lock trait unsafe.

[wedsonaf]

Without this, one could implement a lock that doesn't really provide
mutual exclusion, which could result in UB. For example, a no-op Lock
implementation could provide guards from two different threads
concurrently, which could be used by LockedBy to generate two mutable
references to the same underlying object.

Marking Lock unsafe has no implication on driver code because all
implementations are expected to come from the kernel crate anyway.

Signed-off-by: Wedson Almeida Filho [email protected]

[nbdd0121]

Yeah, this definitely has to be unsafe.

I wonder if we should also separate the UnsafeCell from the lock itself, essentially create RawMutex and RawSpinLock like lock_api do https://docs.rs/lock_api/0.4.5/lock_api/trait.RawMutex.html. (Just an idea, no need to address for this PR)

[wedsonaf]

Yeah, this definitely has to be unsafe.

I wonder if we should also separate the UnsafeCell from the lock itself, essentially create RawMutex and RawSpinLock like lock_api do https://docs.rs/lock_api/0.4.5/lock_api/trait.RawMutex.html. (Just an idea, no need to address for this PR)

The goal would be to reduce duplication of some of the boiler plate code around UnsafeCell?

[nbdd0121]

The goal would be to reduce duplication of some of the boiler plate code around UnsafeCell?

Yes, and it should also allow us to make Guard covariant. (The use of projection L::Inner would make L invariant). This would allow us to "usize" the guard (thouhg this would require the unstable CoerceUnsized). I have recently used the unsizing of core::cell::Ref in my personal project and I find it quite useful in some circumstances.

[ojeda]

(We are already using coerce_unsized for Ref)