@penguin42 @gregkh Rust's type system persists into `unsafe` blocks, including e.g. lifetime checks. The remove function itself depends on two lifetime-bound entities and relies on the fact that the references are real to prove certain operations are correct to perform.

The problem is the safety requirement for this function is "leaky", because it includes a requirement about *other* lists. This safety requirement was one chosen by the kernel programmers, though, not Rust.