kernel/
error.rs

1// SPDX-License-Identifier: GPL-2.0
2
3//! Kernel errors.
4//!
5//! C header: [`include/uapi/asm-generic/errno-base.h`](srctree/include/uapi/asm-generic/errno-base.h)\
6//! C header: [`include/uapi/asm-generic/errno.h`](srctree/include/uapi/asm-generic/errno.h)\
7//! C header: [`include/linux/errno.h`](srctree/include/linux/errno.h)
8
9use crate::{
10    alloc::{layout::LayoutError, AllocError},
11    fmt,
12    str::CStr,
13};
14
15use core::num::NonZeroI32;
16use core::num::TryFromIntError;
17use core::str::Utf8Error;
18
19/// Contains the C-compatible error codes.
20#[rustfmt::skip]
21pub mod code {
22    macro_rules! declare_err {
23        ($err:tt $(,)? $($doc:expr),+) => {
24            $(
25            #[doc = $doc]
26            )*
27            pub const $err: super::Error =
28                match super::Error::try_from_errno(-(crate::bindings::$err as i32)) {
29                    Some(err) => err,
30                    None => panic!("Invalid errno in `declare_err!`"),
31                };
32        };
33    }
34
35    declare_err!(EPERM, "Operation not permitted.");
36    declare_err!(ENOENT, "No such file or directory.");
37    declare_err!(ESRCH, "No such process.");
38    declare_err!(EINTR, "Interrupted system call.");
39    declare_err!(EIO, "I/O error.");
40    declare_err!(ENXIO, "No such device or address.");
41    declare_err!(E2BIG, "Argument list too long.");
42    declare_err!(ENOEXEC, "Exec format error.");
43    declare_err!(EBADF, "Bad file number.");
44    declare_err!(ECHILD, "No child processes.");
45    declare_err!(EAGAIN, "Try again.");
46    declare_err!(ENOMEM, "Out of memory.");
47    declare_err!(EACCES, "Permission denied.");
48    declare_err!(EFAULT, "Bad address.");
49    declare_err!(ENOTBLK, "Block device required.");
50    declare_err!(EBUSY, "Device or resource busy.");
51    declare_err!(EEXIST, "File exists.");
52    declare_err!(EXDEV, "Cross-device link.");
53    declare_err!(ENODEV, "No such device.");
54    declare_err!(ENOTDIR, "Not a directory.");
55    declare_err!(EISDIR, "Is a directory.");
56    declare_err!(EINVAL, "Invalid argument.");
57    declare_err!(ENFILE, "File table overflow.");
58    declare_err!(EMFILE, "Too many open files.");
59    declare_err!(ENOTTY, "Not a typewriter.");
60    declare_err!(ETXTBSY, "Text file busy.");
61    declare_err!(EFBIG, "File too large.");
62    declare_err!(ENOSPC, "No space left on device.");
63    declare_err!(ESPIPE, "Illegal seek.");
64    declare_err!(EROFS, "Read-only file system.");
65    declare_err!(EMLINK, "Too many links.");
66    declare_err!(EPIPE, "Broken pipe.");
67    declare_err!(EDOM, "Math argument out of domain of func.");
68    declare_err!(ERANGE, "Math result not representable.");
69    declare_err!(EOVERFLOW, "Value too large for defined data type.");
70    declare_err!(ETIMEDOUT, "Connection timed out.");
71    declare_err!(ERESTARTSYS, "Restart the system call.");
72    declare_err!(ERESTARTNOINTR, "System call was interrupted by a signal and will be restarted.");
73    declare_err!(ERESTARTNOHAND, "Restart if no handler.");
74    declare_err!(ENOIOCTLCMD, "No ioctl command.");
75    declare_err!(ERESTART_RESTARTBLOCK, "Restart by calling sys_restart_syscall.");
76    declare_err!(EPROBE_DEFER, "Driver requests probe retry.");
77    declare_err!(EOPENSTALE, "Open found a stale dentry.");
78    declare_err!(ENOPARAM, "Parameter not supported.");
79    declare_err!(EBADHANDLE, "Illegal NFS file handle.");
80    declare_err!(ENOTSYNC, "Update synchronization mismatch.");
81    declare_err!(EBADCOOKIE, "Cookie is stale.");
82    declare_err!(ENOTSUPP, "Operation is not supported.");
83    declare_err!(ETOOSMALL, "Buffer or request is too small.");
84    declare_err!(ESERVERFAULT, "An untranslatable error occurred.");
85    declare_err!(EBADTYPE, "Type not supported by server.");
86    declare_err!(EJUKEBOX, "Request initiated, but will not complete before timeout.");
87    declare_err!(EIOCBQUEUED, "iocb queued, will get completion event.");
88    declare_err!(ERECALLCONFLICT, "Conflict with recalled state.");
89    declare_err!(ENOGRACE, "NFS file lock reclaim refused.");
90}
91
92/// Generic integer kernel error.
93///
94/// The kernel defines a set of integer generic error codes based on C and
95/// POSIX ones. These codes may have a more specific meaning in some contexts.
96///
97/// # Invariants
98///
99/// The value is a valid `errno` (i.e. `>= -MAX_ERRNO && < 0`).
100#[derive(Clone, Copy, PartialEq, Eq)]
101pub struct Error(NonZeroI32);
102
103impl Error {
104    /// Creates an [`Error`] from a kernel error code.
105    ///
106    /// `errno` must be within error code range (i.e. `>= -MAX_ERRNO && < 0`).
107    ///
108    /// It is a bug to pass an out-of-range `errno`. [`code::EINVAL`] is returned in such a case.
109    ///
110    /// # Examples
111    ///
112    /// ```
113    /// assert_eq!(Error::from_errno(-1), EPERM);
114    /// assert_eq!(Error::from_errno(-2), ENOENT);
115    /// ```
116    ///
117    /// The following calls are considered a bug:
118    ///
119    /// ```
120    /// assert_eq!(Error::from_errno(0), EINVAL);
121    /// assert_eq!(Error::from_errno(-1000000), EINVAL);
122    /// ```
123    pub fn from_errno(errno: crate::ffi::c_int) -> Error {
124        if let Some(error) = Self::try_from_errno(errno) {
125            error
126        } else {
127            // TODO: Make it a `WARN_ONCE` once available.
128            crate::pr_warn!(
129                "attempted to create `Error` with out of range `errno`: {}\n",
130                errno
131            );
132            code::EINVAL
133        }
134    }
135
136    /// Creates an [`Error`] from a kernel error code.
137    ///
138    /// Returns [`None`] if `errno` is out-of-range.
139    const fn try_from_errno(errno: crate::ffi::c_int) -> Option<Error> {
140        if errno < -(bindings::MAX_ERRNO as i32) || errno >= 0 {
141            return None;
142        }
143
144        // SAFETY: `errno` is checked above to be in a valid range.
145        Some(unsafe { Error::from_errno_unchecked(errno) })
146    }
147
148    /// Creates an [`Error`] from a kernel error code.
149    ///
150    /// # Safety
151    ///
152    /// `errno` must be within error code range (i.e. `>= -MAX_ERRNO && < 0`).
153    const unsafe fn from_errno_unchecked(errno: crate::ffi::c_int) -> Error {
154        // INVARIANT: The contract ensures the type invariant
155        // will hold.
156        // SAFETY: The caller guarantees `errno` is non-zero.
157        Error(unsafe { NonZeroI32::new_unchecked(errno) })
158    }
159
160    /// Returns the kernel error code.
161    pub fn to_errno(self) -> crate::ffi::c_int {
162        self.0.get()
163    }
164
165    #[cfg(CONFIG_BLOCK)]
166    pub(crate) fn to_blk_status(self) -> bindings::blk_status_t {
167        // SAFETY: `self.0` is a valid error due to its invariant.
168        unsafe { bindings::errno_to_blk_status(self.0.get()) }
169    }
170
171    /// Returns the error encoded as a pointer.
172    pub fn to_ptr<T>(self) -> *mut T {
173        // SAFETY: `self.0` is a valid error due to its invariant.
174        unsafe { bindings::ERR_PTR(self.0.get() as crate::ffi::c_long).cast() }
175    }
176
177    /// Returns a string representing the error, if one exists.
178    #[cfg(not(testlib))]
179    pub fn name(&self) -> Option<&'static CStr> {
180        // SAFETY: Just an FFI call, there are no extra safety requirements.
181        let ptr = unsafe { bindings::errname(-self.0.get()) };
182        if ptr.is_null() {
183            None
184        } else {
185            // SAFETY: The string returned by `errname` is static and `NUL`-terminated.
186            Some(unsafe { CStr::from_char_ptr(ptr) })
187        }
188    }
189
190    /// Returns a string representing the error, if one exists.
191    ///
192    /// When `testlib` is configured, this always returns `None` to avoid the dependency on a
193    /// kernel function so that tests that use this (e.g., by calling [`Result::unwrap`]) can still
194    /// run in userspace.
195    #[cfg(testlib)]
196    pub fn name(&self) -> Option<&'static CStr> {
197        None
198    }
199}
200
201impl fmt::Debug for Error {
202    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
203        match self.name() {
204            // Print out number if no name can be found.
205            None => f.debug_tuple("Error").field(&-self.0).finish(),
206            Some(name) => f
207                .debug_tuple(
208                    // SAFETY: These strings are ASCII-only.
209                    unsafe { core::str::from_utf8_unchecked(name.to_bytes()) },
210                )
211                .finish(),
212        }
213    }
214}
215
216impl From<AllocError> for Error {
217    fn from(_: AllocError) -> Error {
218        code::ENOMEM
219    }
220}
221
222impl From<TryFromIntError> for Error {
223    fn from(_: TryFromIntError) -> Error {
224        code::EINVAL
225    }
226}
227
228impl From<Utf8Error> for Error {
229    fn from(_: Utf8Error) -> Error {
230        code::EINVAL
231    }
232}
233
234impl From<LayoutError> for Error {
235    fn from(_: LayoutError) -> Error {
236        code::ENOMEM
237    }
238}
239
240impl From<fmt::Error> for Error {
241    fn from(_: fmt::Error) -> Error {
242        code::EINVAL
243    }
244}
245
246impl From<core::convert::Infallible> for Error {
247    fn from(e: core::convert::Infallible) -> Error {
248        match e {}
249    }
250}
251
252/// A [`Result`] with an [`Error`] error type.
253///
254/// To be used as the return type for functions that may fail.
255///
256/// # Error codes in C and Rust
257///
258/// In C, it is common that functions indicate success or failure through
259/// their return value; modifying or returning extra data through non-`const`
260/// pointer parameters. In particular, in the kernel, functions that may fail
261/// typically return an `int` that represents a generic error code. We model
262/// those as [`Error`].
263///
264/// In Rust, it is idiomatic to model functions that may fail as returning
265/// a [`Result`]. Since in the kernel many functions return an error code,
266/// [`Result`] is a type alias for a [`core::result::Result`] that uses
267/// [`Error`] as its error type.
268///
269/// Note that even if a function does not return anything when it succeeds,
270/// it should still be modeled as returning a [`Result`] rather than
271/// just an [`Error`].
272///
273/// Calling a function that returns [`Result`] forces the caller to handle
274/// the returned [`Result`].
275///
276/// This can be done "manually" by using [`match`]. Using [`match`] to decode
277/// the [`Result`] is similar to C where all the return value decoding and the
278/// error handling is done explicitly by writing handling code for each
279/// error to cover. Using [`match`] the error and success handling can be
280/// implemented in all detail as required. For example (inspired by
281/// [`samples/rust/rust_minimal.rs`]):
282///
283/// ```
284/// # #[allow(clippy::single_match)]
285/// fn example() -> Result {
286///     let mut numbers = KVec::new();
287///
288///     match numbers.push(72, GFP_KERNEL) {
289///         Err(e) => {
290///             pr_err!("Error pushing 72: {e:?}");
291///             return Err(e.into());
292///         }
293///         // Do nothing, continue.
294///         Ok(()) => (),
295///     }
296///
297///     match numbers.push(108, GFP_KERNEL) {
298///         Err(e) => {
299///             pr_err!("Error pushing 108: {e:?}");
300///             return Err(e.into());
301///         }
302///         // Do nothing, continue.
303///         Ok(()) => (),
304///     }
305///
306///     match numbers.push(200, GFP_KERNEL) {
307///         Err(e) => {
308///             pr_err!("Error pushing 200: {e:?}");
309///             return Err(e.into());
310///         }
311///         // Do nothing, continue.
312///         Ok(()) => (),
313///     }
314///
315///     Ok(())
316/// }
317/// # example()?;
318/// # Ok::<(), Error>(())
319/// ```
320///
321/// An alternative to be more concise is the [`if let`] syntax:
322///
323/// ```
324/// fn example() -> Result {
325///     let mut numbers = KVec::new();
326///
327///     if let Err(e) = numbers.push(72, GFP_KERNEL) {
328///         pr_err!("Error pushing 72: {e:?}");
329///         return Err(e.into());
330///     }
331///
332///     if let Err(e) = numbers.push(108, GFP_KERNEL) {
333///         pr_err!("Error pushing 108: {e:?}");
334///         return Err(e.into());
335///     }
336///
337///     if let Err(e) = numbers.push(200, GFP_KERNEL) {
338///         pr_err!("Error pushing 200: {e:?}");
339///         return Err(e.into());
340///     }
341///
342///     Ok(())
343/// }
344/// # example()?;
345/// # Ok::<(), Error>(())
346/// ```
347///
348/// Instead of these verbose [`match`]/[`if let`], the [`?`] operator can
349/// be used to handle the [`Result`]. Using the [`?`] operator is often
350/// the best choice to handle [`Result`] in a non-verbose way as done in
351/// [`samples/rust/rust_minimal.rs`]:
352///
353/// ```
354/// fn example() -> Result {
355///     let mut numbers = KVec::new();
356///
357///     numbers.push(72, GFP_KERNEL)?;
358///     numbers.push(108, GFP_KERNEL)?;
359///     numbers.push(200, GFP_KERNEL)?;
360///
361///     Ok(())
362/// }
363/// # example()?;
364/// # Ok::<(), Error>(())
365/// ```
366///
367/// Another possibility is to call [`unwrap()`](Result::unwrap) or
368/// [`expect()`](Result::expect). However, use of these functions is
369/// *heavily discouraged* in the kernel because they trigger a Rust
370/// [`panic!`] if an error happens, which may destabilize the system or
371/// entirely break it as a result -- just like the C [`BUG()`] macro.
372/// Please see the documentation for the C macro [`BUG()`] for guidance
373/// on when to use these functions.
374///
375/// Alternatively, depending on the use case, using [`unwrap_or()`],
376/// [`unwrap_or_else()`], [`unwrap_or_default()`] or [`unwrap_unchecked()`]
377/// might be an option, as well.
378///
379/// For even more details, please see the [Rust documentation].
380///
381/// [`match`]: https://doc.rust-lang.org/reference/expressions/match-expr.html
382/// [`samples/rust/rust_minimal.rs`]: srctree/samples/rust/rust_minimal.rs
383/// [`if let`]: https://doc.rust-lang.org/reference/expressions/if-expr.html#if-let-expressions
384/// [`?`]: https://doc.rust-lang.org/reference/expressions/operator-expr.html#the-question-mark-operator
385/// [`unwrap()`]: Result::unwrap
386/// [`expect()`]: Result::expect
387/// [`BUG()`]: https://docs.kernel.org/process/deprecated.html#bug-and-bug-on
388/// [`unwrap_or()`]: Result::unwrap_or
389/// [`unwrap_or_else()`]: Result::unwrap_or_else
390/// [`unwrap_or_default()`]: Result::unwrap_or_default
391/// [`unwrap_unchecked()`]: Result::unwrap_unchecked
392/// [Rust documentation]: https://doc.rust-lang.org/book/ch09-02-recoverable-errors-with-result.html
393pub type Result<T = (), E = Error> = core::result::Result<T, E>;
394
395/// Converts an integer as returned by a C kernel function to a [`Result`].
396///
397/// If the integer is negative, an [`Err`] with an [`Error`] as given by [`Error::from_errno`] is
398/// returned. This means the integer must be `>= -MAX_ERRNO`.
399///
400/// Otherwise, it returns [`Ok`].
401///
402/// It is a bug to pass an out-of-range negative integer. `Err(EINVAL)` is returned in such a case.
403///
404/// # Examples
405///
406/// This function may be used to easily perform early returns with the [`?`] operator when working
407/// with C APIs within Rust abstractions:
408///
409/// ```
410/// # use kernel::error::to_result;
411/// # mod bindings {
412/// #     #![expect(clippy::missing_safety_doc)]
413/// #     use kernel::prelude::*;
414/// #     pub(super) unsafe fn f1() -> c_int { 0 }
415/// #     pub(super) unsafe fn f2() -> c_int { EINVAL.to_errno() }
416/// # }
417/// fn f() -> Result {
418///     // SAFETY: ...
419///     to_result(unsafe { bindings::f1() })?;
420///
421///     // SAFETY: ...
422///     to_result(unsafe { bindings::f2() })?;
423///
424///     // ...
425///
426///     Ok(())
427/// }
428/// # assert_eq!(f(), Err(EINVAL));
429/// ```
430///
431/// [`?`]: https://doc.rust-lang.org/reference/expressions/operator-expr.html#the-question-mark-operator
432pub fn to_result(err: crate::ffi::c_int) -> Result {
433    if err < 0 {
434        Err(Error::from_errno(err))
435    } else {
436        Ok(())
437    }
438}
439
440/// Transform a kernel "error pointer" to a normal pointer.
441///
442/// Some kernel C API functions return an "error pointer" which optionally
443/// embeds an `errno`. Callers are supposed to check the returned pointer
444/// for errors. This function performs the check and converts the "error pointer"
445/// to a normal pointer in an idiomatic fashion.
446///
447/// # Examples
448///
449/// ```ignore
450/// # use kernel::from_err_ptr;
451/// # use kernel::bindings;
452/// fn devm_platform_ioremap_resource(
453///     pdev: &mut PlatformDevice,
454///     index: u32,
455/// ) -> Result<*mut kernel::ffi::c_void> {
456///     // SAFETY: `pdev` points to a valid platform device. There are no safety requirements
457///     // on `index`.
458///     from_err_ptr(unsafe { bindings::devm_platform_ioremap_resource(pdev.to_ptr(), index) })
459/// }
460/// ```
461pub fn from_err_ptr<T>(ptr: *mut T) -> Result<*mut T> {
462    // CAST: Casting a pointer to `*const crate::ffi::c_void` is always valid.
463    let const_ptr: *const crate::ffi::c_void = ptr.cast();
464    // SAFETY: The FFI function does not deref the pointer.
465    if unsafe { bindings::IS_ERR(const_ptr) } {
466        // SAFETY: The FFI function does not deref the pointer.
467        let err = unsafe { bindings::PTR_ERR(const_ptr) };
468
469        #[allow(clippy::unnecessary_cast)]
470        // CAST: If `IS_ERR()` returns `true`,
471        // then `PTR_ERR()` is guaranteed to return a
472        // negative value greater-or-equal to `-bindings::MAX_ERRNO`,
473        // which always fits in an `i16`, as per the invariant above.
474        // And an `i16` always fits in an `i32`. So casting `err` to
475        // an `i32` can never overflow, and is always valid.
476        //
477        // SAFETY: `IS_ERR()` ensures `err` is a
478        // negative value greater-or-equal to `-bindings::MAX_ERRNO`.
479        return Err(unsafe { Error::from_errno_unchecked(err as crate::ffi::c_int) });
480    }
481    Ok(ptr)
482}
483
484/// Calls a closure returning a [`crate::error::Result<T>`] and converts the result to
485/// a C integer result.
486///
487/// This is useful when calling Rust functions that return [`crate::error::Result<T>`]
488/// from inside `extern "C"` functions that need to return an integer error result.
489///
490/// `T` should be convertible from an `i16` via `From<i16>`.
491///
492/// # Examples
493///
494/// ```ignore
495/// # use kernel::from_result;
496/// # use kernel::bindings;
497/// unsafe extern "C" fn probe_callback(
498///     pdev: *mut bindings::platform_device,
499/// ) -> kernel::ffi::c_int {
500///     from_result(|| {
501///         let ptr = devm_alloc(pdev)?;
502///         bindings::platform_set_drvdata(pdev, ptr);
503///         Ok(0)
504///     })
505/// }
506/// ```
507pub fn from_result<T, F>(f: F) -> T
508where
509    T: From<i16>,
510    F: FnOnce() -> Result<T>,
511{
512    match f() {
513        Ok(v) => v,
514        // NO-OVERFLOW: negative `errno`s are no smaller than `-bindings::MAX_ERRNO`,
515        // `-bindings::MAX_ERRNO` fits in an `i16` as per invariant above,
516        // therefore a negative `errno` always fits in an `i16` and will not overflow.
517        Err(e) => T::from(e.to_errno() as i16),
518    }
519}
520
521/// Error message for calling a default function of a [`#[vtable]`](macros::vtable) trait.
522pub const VTABLE_DEFAULT_ERROR: &str =
523    "This function must not be called, see the #[vtable] documentation.";