rust: add safety annotations to str.rs

Signed-off-by: Gary Guo <[email protected]>

Author: nbdd0121

rust/kernel/str.rs

@@ -89,10 +89,14 @@ impl CStr {
     /// must not be mutated.
     #[inline]
     pub unsafe fn from_char_ptr<'a>(ptr: *const c_types::c_char) -> &'a Self {
+        // SAFETY: The safety precondition guarantees `ptr` is a valid pointer
+        // to a `NUL`-terminated C string.
         let len = unsafe { bindings::strlen(ptr) } + 1;
-        unsafe {
-            Self::from_bytes_with_nul_unchecked(core::slice::from_raw_parts(ptr as _, len as _))
-        }
+        // SAFETY: lifetime guaranteed by the safety precondition.
+        let bytes = unsafe { core::slice::from_raw_parts(ptr as _, len as _) };
+        // SAFETY: as `len` is returned by `strlen`, `bytes` does not contain interior `NUL`.
+        // As we have added 1 to `len`, the last byte is known to be `NUL`.
+        unsafe { Self::from_bytes_with_nul_unchecked(bytes) }
     }
 
     /// Creates a [`CStr`] from a `[u8]`.
@@ -146,6 +150,7 @@ impl CStr {
         // requires `ptr_metadata`).
         // While none of them are current stable, it is very likely that one of
         // them will eventually be.
+        // SAFETY: properties of `bytes` guaranteed by the safety precondition.
         unsafe { &*(bytes as *const [u8] as *const Self) }
     }