A pointer handed in by a user program is not a pointer the kernel may follow: it may be invalid, it may belong to another process, it may be a trick to make the kernel read something it should not. Every transfer must go through the dedicated copy routines, which check the address and can fail. The Rust wrapper makes this a type: you get a reader or a writer over a stated number of bytes, each read consumes from it, and there is no way to accidentally dereference the raw address. This closes an entire family of privilege-escalation bugs that have shipped in real C drivers.
This page documents the safe Rust way to move data between a driver and a user-space program. A user-space address is never dereferenced directly, because the program could unmap it or hand you someo…