executor: mark task_from_waker as safe.

embassy/src/executor/raw/waker.rs

@@ -33,12 +33,18 @@ pub(crate) unsafe fn from_task(p: NonNull<TaskHeader>) -> Waker {
 /// # Panics
 ///
 /// Panics if the waker is not created by the Embassy executor.
-pub unsafe fn task_from_waker(waker: &Waker) -> NonNull<TaskHeader> {
-    let hack: &WakerHack = mem::transmute(waker);
+pub fn task_from_waker(waker: &Waker) -> NonNull<TaskHeader> {
+    // safety: OK because WakerHack has the same layout as Waker.
+    // This is not really guaranteed because the structs are `repr(Rust)`, it is
+    // indeed the case in the current implementation.
+    // TODO use waker_getters when stable. https://github.com/rust-lang/rust/issues/96992
+    let hack: &WakerHack = unsafe { mem::transmute(waker) };
     if hack.vtable != &VTABLE {
         panic!("Found waker not created by the embassy executor. Consider enabling the `executor-agnostic` feature on the `embassy` crate.")
     }
-    NonNull::new_unchecked(hack.data as *mut TaskHeader)
+
+    // safety: we never create a waker with a null data pointer.
+    unsafe { NonNull::new_unchecked(hack.data as *mut TaskHeader) }
 }
 
 struct WakerHack {

embassy/src/waitqueue/waker.rs

@@ -22,7 +22,7 @@ impl WakerRegistration {
 
     /// Register a waker. Overwrites the previous waker, if any.
     pub fn register(&mut self, w: &Waker) {
-        let w = unsafe { task_from_waker(w) };
+        let w = task_from_waker(w);
         match self.waker {
             // Optimization: If both the old and new Wakers wake the same task, do nothing.
             Some(w2) if w == w2 => {}
@@ -80,7 +80,7 @@ impl AtomicWaker {
 
     /// Register a waker. Overwrites the previous waker, if any.
     pub fn register(&self, w: &Waker) {
-        let w = unsafe { task_from_waker(w) };
+        let w = task_from_waker(w);
         self.waker.store(w.as_ptr(), Ordering::Relaxed);
         compiler_fence(Ordering::SeqCst);
     }