Stricter lints, doc and dependency checks

Cargo.toml

@@ -42,3 +42,18 @@ tempfile = "3"
 [profile.release]
 lto = true
 codegen-units = 1
+
+# CI runs clippy with -D warnings, so everything here set to "warn" fails CI.
+[lints.rust]
+rust_2018_idioms = { level = "warn", priority = -1 }
+unused_qualifications = "warn"
+unsafe_op_in_unsafe_fn = "warn"
+
+[lints.clippy]
+# Silent integer truncation is the easiest way for 9p message encoding to go wrong.
+cast_possible_truncation = "warn"
+cast_sign_loss = "warn"
+cast_possible_wrap = "warn"
+undocumented_unsafe_blocks = "warn"
+dbg_macro = "warn"
+todo = "warn"

deny.toml

@@ -0,0 +1,18 @@
+# cargo-deny settings. `nix flake check` runs the licenses, bans and sources checks; security
+# advisories are checked by cargo-audit there, since cargo-deny can't download them in the sandbox.
+
+[licenses]
+allow = ["MIT", "Apache-2.0", "Unicode-3.0"]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+
+[advisories]
+ignore = [
+  { id = "RUSTSEC-2021-0154", reason = "Only affects fuser's libfuse code, which we build without (default-features = false)." },
+]

flake.nix

@@ -5,9 +5,14 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     crane.url = "github:ipetkov/crane";
     flake-utils.url = "github:numtide/flake-utils";
+    # RustSec security advisories, for the audit check. `nix flake update advisory-db` refreshes it.
+    advisory-db = {
+      url = "github:rustsec/advisory-db";
+      flake = false;
+    };
   };
 
-  outputs = { self, nixpkgs, crane, flake-utils }:
+  outputs = { self, nixpkgs, crane, flake-utils, advisory-db }:
     flake-utils.lib.eachDefaultSystem (system:
       let
         pkgs = import nixpkgs { inherit system; };
@@ -46,14 +51,30 @@
         packages.default = p9fuse;
         packages.p9fuse = p9fuse;
 
-        # `nix flake check` runs all of these: build, clippy (-D warnings), and rustfmt.
+        # `nix flake check` runs all of these: build, clippy (-D warnings), docs (-D warnings),
+        # rustfmt, and dependency checks.
         checks = {
           inherit p9fuse;
           clippy = craneLib.cargoClippy (commonArgs // {
             inherit cargoArtifacts;
             cargoClippyExtraArgs = "--all-targets -- -D warnings";
           });
+          doc = craneLib.cargoDoc (commonArgs // {
+            inherit cargoArtifacts;
+            RUSTDOCFLAGS = "-D warnings";
+          });
           fmt = craneLib.cargoFmt { inherit (commonArgs) src; };
+          # Licenses, banned crates and crate sources, as configured in deny.toml.
+          deny = craneLib.cargoDeny {
+            src = ./.;
+            cargoDenyChecks = "bans licenses sources";
+          };
+          # Known security advisories, including unsound ones.
+          audit = craneLib.cargoAudit {
+            inherit advisory-db;
+            src = ./.;
+            cargoAuditExtraArgs = "--deny unsound --ignore RUSTSEC-2021-0154";
+          };
         };
 
         devShells.default = craneLib.devShell {

src/client.rs

@@ -214,6 +214,7 @@ impl NineClient {
     /// Send a T-message body and await the matching response. Returns Err(errno) on Rlerror or a
     /// transport/protocol failure (mapped to EIO).
     async fn transact(&self, mtype: u8, tag: u16, body: &[u8]) -> Result<Frame, i32> {
+        let size = u32::try_from(4 + 1 + 2 + body.len()).map_err(|_| libc::EMSGSIZE)?;
         let (tx, rx) = oneshot::channel();
         let displaced = self.pending.lock().unwrap().insert(
             tag,
@@ -236,7 +237,6 @@ impl NineClient {
             );
         }
 
-        let size = (4 + 1 + 2 + body.len()) as u32;
         let mut frame = Vec::with_capacity(size as usize);
         frame.extend_from_slice(&size.to_le_bytes());
         frame.push(mtype);
@@ -254,8 +254,8 @@ impl NineClient {
         match rx.await {
             Ok(resp) => {
                 if resp.typ == RLERROR {
-                    let ecode = R::new(&resp.body).u32().unwrap_or(libc::EIO as u32);
-                    Err(ecode as i32)
+                    let ecode = R::new(&resp.body).u32().and_then(|e| i32::try_from(e).ok());
+                    Err(ecode.unwrap_or(libc::EIO))
                 } else {
                     Ok(resp)
                 }
@@ -330,7 +330,8 @@ impl NineClient {
     /// that short reply is mapped to ENOENT here to keep the rule "Err means no fid" exact.
     pub async fn walk(&self, fid: u32, newfid: u32, names: &[&str]) -> Result<Vec<Qid>, i32> {
         let mut w = W::new();
-        w.u32(fid).u32(newfid).u16(names.len() as u16);
+        let count = u16::try_from(names.len()).map_err(|_| libc::EINVAL)?;
+        w.u32(fid).u32(newfid).u16(count);
         for n in names {
             w.str(n);
         }
@@ -437,7 +438,8 @@ impl NineClient {
 
     pub async fn write(&self, fid: u32, offset: u64, data: &[u8]) -> Result<u32, i32> {
         let mut w = W::new();
-        w.u32(fid).u64(offset).u32(data.len() as u32).bytes(data);
+        let count = u32::try_from(data.len()).map_err(|_| libc::EINVAL)?;
+        w.u32(fid).u64(offset).u32(count).bytes(data);
         let body = self.req(TWRITE, RWRITE, &w.buf).await?;
         R::new(&body).u32().ok_or(libc::EIO)
     }

src/fuse9p/attr.rs

@@ -15,11 +15,14 @@ pub(super) fn to_fileattr(ino: u64, a: &Attr) -> FileAttr {
         crtime: UNIX_EPOCH,
         kind: kind_from_mode(a.mode),
         perm: (a.mode & 0o7777) as u16,
-        nlink: a.nlink.max(1) as u32,
+        nlink: u32::try_from(a.nlink.max(1)).unwrap_or(u32::MAX),
         uid: a.uid,
         gid: a.gid,
+        // The low 32 bits of a glibc dev_t are the kernel's encoding for devices with major
+        // numbers below 4096, which covers real devices.
+        #[allow(clippy::cast_possible_truncation)]
         rdev: a.rdev as u32,
-        blksize: a.blksize.max(512) as u32,
+        blksize: u32::try_from(a.blksize.max(512)).unwrap_or(u32::MAX),
         flags: 0,
     }
 }
@@ -67,7 +70,8 @@ pub(super) fn time_or_now(t: TimeOrNow) -> (u64, u64) {
 }
 
 fn unixtime((sec, nsec): (u64, u64)) -> SystemTime {
-    UNIX_EPOCH + Duration::new(sec, (nsec as u32).min(999_999_999))
+    let nsec = u32::try_from(nsec.min(999_999_999)).unwrap_or(0);
+    UNIX_EPOCH + Duration::new(sec, nsec)
 }
 
 fn kind_from_mode(mode: u32) -> FileType {