It's true that the naiive version of this API which passes &mut [u8] to io_uring or the like can't be made sound, since there's no guarantee that you'll be able to run code before the [u8] goes away. You can get around this, though, with something like a Pin<&mut IoUringBuf> where the underlying buffer is !Unpin and will deregister itself from the async read before deallocating memory. This is unfortunate in that you can't just use "normal" &mut [u8] like you'd ideally want, but it's definitely workable. I've spent a good amount of time thinking about this, and I don't think we could've done this any other way based on Rust's existing set of guarantees/non-guarantees.
3 Likes