Taking a raw ref (`&raw (const|mut)`) of a deref of pointer (`*ptr`) is always safe #129248

compiler-errors · 2024-08-18T18:36:15Z

T-opsem decided in rust-lang/reference#1387 that *ptr is only unsafe if the place is accessed. This means that taking a raw ref of a deref expr is always safe, since it doesn't constitute a read.

This also relaxes the DEREF_NULLPTR lint to stop warning in the case of raw ref of a deref'd nullptr, and updates its docs to reflect that change in the UB specification.

This does not change the behavior of addr_of!((*ptr).field), since field projections still require the projection is in-bounds.

I'm on the fence whether this requires an FCP, since it's something that is guaranteed by the reference you could ostensibly call this a bugfix since we were counting truly safe operations as unsafe. Perhaps someone on opsem has a strong opinion? cc @rust-lang/opsem

rustbot · 2024-08-18T18:36:24Z

r? @nnethercote

rustbot has assigned @nnethercote.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

RalfJung · 2024-08-18T19:00:57Z

Seems more like a lang question to me than an opsem question -- from an opsem side, the relevant question is whether there is UB, and the answer is "no". But from a lang perspective, it may seem odd to have unsafe rules that depend on the place-vs-value distinction, as many programmers do not properly understand this distinction. But maybe it's good that they will wonder " 🤔 why is this safe?" and then can be taught about said distinction?

Also note that due to #117288, sometimes we do have UB just from constructing a place. That's a MIR building bug but we should probably fix it before accepting such code as safe. (Sorry I didn't remember this when we spoke earlier.)

compiler-errors · 2024-08-18T19:03:10Z

👍 yep, this could be blocked on #117288 then. I think we can probably T-lang-nominate this regardless for discussion.

nnethercote · 2024-08-18T23:36:37Z

The code changes seem fine, so r=me on them if/when lang/opsem are happy with this.

scottmcm · 2024-08-21T15:32:18Z

Thinking about the DEREF_NULLPTR relaxation, I was pondering whether we should still lint -- but not say "this is UB" when it's not, of course -- on this as something that we might want you to do in a different way instead. @compiler-errors convinced me that rustc is not the correct place for that, however, and a "clippy suspicious" or similar would be the place to do that instead, if useful.

traviscross · 2024-08-21T16:30:15Z

@rustbot labels -I-lang-nominated

We discussed this in lang triage today and agreed that this was both a good idea and one that's a natural consequence of our other recent decisions and so can go without FCP.

@bors r=nnethercode

bors · 2024-08-21T16:30:18Z

📌 Commit 25d617f has been approved by nnethercode

It is now in the queue for this repository.

compiler-errors · 2024-08-21T16:33:22Z

@bors r-

This is still unsound!! #117288

traviscross · 2024-08-21T16:34:56Z

Good catch. Thanks.

tests/ui/static/raw-ref-deref-without-unsafe.rs

compiler/rustc_mir_build/src/check_unsafety.rs

workingjubilee · 2024-08-22T03:18:15Z

warning: the feature raw_ref_op has been stable since 1.82.0-nightly and no longer requires an attribute to enable

Truly?!

RalfJung · 2024-08-22T05:54:33Z

Yes, truly. :)

#127679

RalfJung · 2024-08-22T11:12:47Z

So let _ = *raw_ptr; and match *raw_ptr { _ => ... } are not affected by this?

That does seem a bit inconsistent. It doesn't seem super useful to write code like that, but then it doesn't seem super useful to write &raw const *ptr either.

compiler-errors · 2024-08-22T12:45:58Z

@RalfJung: No, that would need to have another special case in the THIR.

bors · 2024-09-15T14:40:42Z

☔ The latest upstream changes (presumably #130390) made this pull request unmergeable. Please resolve the merge conflicts.

compiler-errors · 2024-10-07T02:02:28Z

That does seem a bit inconsistent. It doesn't seem super useful to write code like that, but then it doesn't seem super useful to write &raw const *ptr either.

🤷 I'd still like to fix it, regardless, I think, especially now that #117288 is closed. I'd also like if let _ = *raw_ptr; weren't unsafe, but that's far more difficult for unsafeck to implement.

scottmcm · 2024-10-07T02:42:46Z

I'd also like if let _ = *raw_ptr; weren't unsafe

I mean, we intentionally changed it to require being in an unsafe block...

compiler-errors · 2024-10-07T02:45:18Z

Because it was unsound? Could you provide some context?

compiler-errors · 2024-10-11T08:21:08Z

also this is

@rustbot ready

:D

nnethercote · 2024-10-11T20:46:13Z

@RalfJung, @scottmcm: any objections before I approve this?

RalfJung · 2024-10-12T07:38:38Z

Procedurally it has been approved by t-lang. I'm not very familiar with THIR so it's hard for me to say whether the implementation matches the intent. We don't have a dedicated test for the cases that should be rejected, but tests/ui/lint/lint-deref-nullptr.rs and tests/ui/static/raw-ref-deref-without-unsafe.rs to cover the most important cases I can think of.

nnethercote · 2024-10-24T08:29:29Z

I think this has waited long enough.

@bors r+

bors · 2024-10-24T08:29:32Z

📌 Commit 367183b has been approved by nnethercote

It is now in the queue for this repository.

…iaskrgr Rollup of 5 pull requests Successful merges: - rust-lang#129248 (Taking a raw ref (`&raw (const|mut)`) of a deref of pointer (`*ptr`) is always safe) - rust-lang#131906 (rustdoc: adjust spacing and typography in header) - rust-lang#132084 (Consider param-env candidates even if they have errors) - rust-lang#132096 (Replace an FTP link in comments with an equivalent HTTPS link) - rust-lang#132098 (rustc_feature::Features: explain what that 'Option<Symbol>' is about) r? `@ghost` `@rustbot` modify labels: rollup

Rollup merge of rust-lang#129248 - compiler-errors:raw-ref-deref, r=nnethercote Taking a raw ref (`&raw (const|mut)`) of a deref of pointer (`*ptr`) is always safe T-opsem decided in rust-lang/reference#1387 that `*ptr` is only unsafe if the place is accessed. This means that taking a raw ref of a deref expr is always safe, since it doesn't constitute a read. This also relaxes the `DEREF_NULLPTR` lint to stop warning in the case of raw ref of a deref'd nullptr, and updates its docs to reflect that change in the UB specification. This does not change the behavior of `addr_of!((*ptr).field)`, since field projections still require the projection is in-bounds. I'm on the fence whether this requires an FCP, since it's something that is guaranteed by the reference you could ostensibly call this a bugfix since we were counting truly safe operations as unsafe. Perhaps someone on opsem has a strong opinion? cc `@rust-lang/opsem`

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [rust](https://github.com/rust-lang/rust) | minor | `1.83.0` -> `1.84.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>rust-lang/rust (rust)</summary> ### [`v1.84.0`](https://github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1840-2025-01-09) [Compare Source](rust-lang/rust@1.83.0...1.84.0) \========================== <a id=" Language"></a> ## Language - [Allow `#[deny]` inside `#[forbid]` as a no-op](rust-lang/rust#121560) - [Show a warning when `-Ctarget-feature` is used to toggle features that can lead to unsoundness due to ABI mismatches](rust-lang/rust#129884) - [Use the next-generation trait solver in coherence](rust-lang/rust#130654) - [Allow coercions to drop the principal of trait objects](rust-lang/rust#131857) - [Support `/` as the path separator for `include!()` in all cases on Windows](rust-lang/rust#125205) - [Taking a raw ref (`raw (const|mut)`) of a deref of a pointer (`*ptr`) is now safe](rust-lang/rust#129248) - [Stabilize s390x inline assembly](rust-lang/rust#131258) - [Stabilize Arm64EC inline assembly](rust-lang/rust#131781) - [Lint against creating pointers to immediately dropped temporaries](rust-lang/rust#128985) - [Execute drop glue when unwinding in an `extern "C"` function](rust-lang/rust#129582) <a id="1.84.0-Compiler"></a> ## Compiler - [Add `--print host-tuple` flag to print the host target tuple and affirm the "target tuple" terminology over "target triple"](rust-lang/rust#125579) - [Declaring functions with a calling convention not supported on the current target now triggers a hard error](rust-lang/rust#129935) - [Set up indirect access to external data for `loongarch64-unknown-linux-{musl,ohos}`](rust-lang/rust#131583) - [Enable XRay instrumentation for LoongArch Linux targets](rust-lang/rust#131818) - [Extend the `unexpected_cfgs` lint to also warn in external macros](rust-lang/rust#132577) - [Stabilize WebAssembly `multivalue`, `reference-types`, and `tail-call` target features](rust-lang/rust#131080) - [Added Tier 2 support for the `wasm32v1-none` target](rust-lang/rust#131487) <a id="1.84.0-Libraries"></a> ## Libraries - [Implement `From<&mut {slice}>` for `Box/Rc/Arc<{slice}>`](rust-lang/rust#129329) - [Move `<float>::copysign`, `<float>::abs`, `<float>::signum` to `core`](rust-lang/rust#131304) - [Add `LowerExp` and `UpperExp` implementations to `NonZero`](rust-lang/rust#131377) - [Implement `FromStr` for `CString` and `TryFrom<CString>` for `String`](rust-lang/rust#130608) - [`std::os::darwin` has been made public](rust-lang/rust#123723) <a id="1.84.0-Stabilized-APIs"></a> ## Stabilized APIs - [`Ipv6Addr::is_unique_local`](https://doc.rust-lang.org/stable/core/net/struct.Ipv6Addr.html#method.is_unique_local) - [`Ipv6Addr::is_unicast_link_local`](https://doc.rust-lang.org/stable/core/net/struct.Ipv6Addr.html#method.is_unicast_link_local) - [`core::ptr::with_exposed_provenance`](https://doc.rust-lang.org/stable/core/ptr/fn.with_exposed_provenance.html) - [`core::ptr::with_exposed_provenance_mut`](https://doc.rust-lang.org/stable/core/ptr/fn.with_exposed_provenance_mut.html) - [`<ptr>::addr`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.addr) - [`<ptr>::expose_provenance`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.expose_provenance) - [`<ptr>::with_addr`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.with_addr) - [`<ptr>::map_addr`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.map_addr) - [`<int>::isqrt`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.isqrt) - [`<int>::checked_isqrt`](https://doc.rust-lang.org/stable/core/primitive.i32.html#method.checked_isqrt) - [`<uint>::isqrt`](https://doc.rust-lang.org/stable/core/primitive.u32.html#method.isqrt) - [`NonZero::isqrt`](https://doc.rust-lang.org/stable/core/num/struct.NonZero.html#impl-NonZero%3Cu128%3E/method.isqrt) - [`core::ptr::without_provenance`](https://doc.rust-lang.org/stable/core/ptr/fn.without_provenance.html) - [`core::ptr::without_provenance_mut`](https://doc.rust-lang.org/stable/core/ptr/fn.without_provenance_mut.html) - [`core::ptr::dangling`](https://doc.rust-lang.org/stable/core/ptr/fn.dangling.html) - [`core::ptr::dangling_mut`](https://doc.rust-lang.org/stable/core/ptr/fn.dangling_mut.html) - [`Pin::as_deref_mut`](https://doc.rust-lang.org/stable/core/pin/struct.Pin.html#method.as_deref_mut) These APIs are now stable in const contexts - [`AtomicBool::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicBool.html#method.from_ptr) - [`AtomicPtr::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicPtr.html#method.from_ptr) - [`AtomicU8::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicU8.html#method.from_ptr) - [`AtomicU16::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicU16.html#method.from_ptr) - [`AtomicU32::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicU32.html#method.from_ptr) - [`AtomicU64::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicU64.html#method.from_ptr) - [`AtomicUsize::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicUsize.html#method.from_ptr) - [`AtomicI8::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicI8.html#method.from_ptr) - [`AtomicI16::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicI16.html#method.from_ptr) - [`AtomicI32::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicI32.html#method.from_ptr) - [`AtomicI64::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicI64.html#method.from_ptr) - [`AtomicIsize::from_ptr`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicIsize.html#method.from_ptr) - [`<ptr>::is_null`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.is_null-1) - [`<ptr>::as_ref`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.as_ref-1) - [`<ptr>::as_mut`](https://doc.rust-lang.org/stable/core/primitive.pointer.html#method.as_mut) - [`Pin::new`](https://doc.rust-lang.org/stable/core/pin/struct.Pin.html#method.new) - [`Pin::new_unchecked`](https://doc.rust-lang.org/stable/core/pin/struct.Pin.html#method.new_unchecked) - [`Pin::get_ref`](https://doc.rust-lang.org/stable/core/pin/struct.Pin.html#method.get_ref) - [`Pin::into_ref`](https://doc.rust-lang.org/stable/core/pin/struct.Pin.html#method.into_ref) - [`Pin::get_mut`](https://doc.rust-lang.org/stable/core/pin/struct.Pin.html#method.get_mut) - [`Pin::get_unchecked_mut`](https://doc.rust-lang.org/stable/core/pin/struct.Pin.html#method.get_unchecked_mut) - [`Pin::static_ref`](https://doc.rust-lang.org/stable/core/pin/struct.Pin.html#method.static_ref) - [`Pin::static_mut`](https://doc.rust-lang.org/stable/core/pin/struct.Pin.html#method.static_mut) <a id="1.84.0-Cargo"></a> ## Cargo - [Stabilize MSRV-aware resolver config](rust-lang/cargo#14639) - [Stabilize resolver v3](rust-lang/cargo#14754) <a id="1.84-Rustdoc"></a> ## Rustdoc - [rustdoc-search: improve type-driven search](rust-lang/rust#127589) <a id="1.84.0-Compatibility-Notes"></a> ## Compatibility Notes - [Enable by default the `LSX` target feature for LoongArch Linux targets](rust-lang/rust#132140) - [The unstable `-Zprofile` flag (“gcov-style” coverage instrumentation) has been removed.](rust-lang/rust#131829) This does not affect the stable flags for coverage instrumentation (`-Cinstrument-coverage`) and profile-guided optimization (`-Cprofile-generate`, `-Cprofile-use`), which are unrelated and remain available. - Support for the target named `wasm32-wasi` has been removed as the target is now named `wasm32-wasip1`. This completes the [transition](rust-lang/compiler-team#607) [plan](rust-lang/compiler-team#695) for this target following [the introduction of `wasm32-wasip1`](rust-lang/rust#120468) in Rust 1.78. Compiler warnings on [use of `wasm32-wasi`](rust-lang/rust#126662) introduced in Rust 1.81 are now gone as well as the target is removed. - [The syntax `&pin (mut|const) T` is now parsed as a type which in theory could affect macro expansion results in some edge cases](rust-lang/rust#130635 (comment)) - [Legacy syntax for calling `std::arch` functions is no longer permitted to declare items or bodies (such as closures, inline consts, or async blocks).](rust-lang/rust#130443 (comment)) - [Declaring functions with a calling convention not supported on the current target now triggers a hard error](rust-lang/rust#129935) - [The next-generation trait solver is now enabled for coherence, fixing multiple soundness issues](rust-lang/rust#130654) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

rustbot assigned nnethercote Aug 18, 2024

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. labels Aug 18, 2024

compiler-errors added T-lang Relevant to the language team, which will review and decide on the PR/issue. I-lang-nominated Nominated for discussion during a lang team meeting. and removed T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. labels Aug 18, 2024

rustbot removed the I-lang-nominated Nominated for discussion during a lang team meeting. label Aug 21, 2024

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Aug 21, 2024

bors added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. labels Aug 21, 2024

compiler-errors added S-blocked Status: Blocked on something else such as an RFC or other implementation work. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Aug 21, 2024

RalfJung mentioned this pull request Aug 21, 2024

incorrect UB when when a ! place is constructed (but not loaded!) #117288

Closed

compiler-errors mentioned this pull request Aug 21, 2024

Special-case raw ref op for diverging check in HIR typeck #129371

Closed

workingjubilee reviewed Aug 22, 2024

View reviewed changes

tests/ui/static/raw-ref-deref-without-unsafe.rs Outdated Show resolved Hide resolved

compiler/rustc_mir_build/src/check_unsafety.rs Outdated Show resolved Hide resolved

compiler-errors force-pushed the raw-ref-deref branch from 25d617f to f3b3e4b Compare August 22, 2024 02:08

This comment has been minimized.

Sign in to view

workingjubilee mentioned this pull request Aug 30, 2024

Tracking issue for release notes of #125834: treat &raw (const|mut) UNSAFE_STATIC implied deref as safe #129578

Closed

4 tasks

compiler-errors added 2 commits October 6, 2024 22:35

A raw ref of a deref is always safe

f2a80a0

Don't emit null pointer lint for raw ref of null deref

367183b

compiler-errors force-pushed the raw-ref-deref branch from f3b3e4b to 367183b Compare October 7, 2024 02:37

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-blocked Status: Blocked on something else such as an RFC or other implementation work. labels Oct 11, 2024

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Oct 24, 2024

matthiaskrgr mentioned this pull request Oct 24, 2024

Rollup of 5 pull requests #132099

Merged

RalfJung added the relnotes Marks issues that should be documented in the release notes of the next release. label Oct 24, 2024

rustbot mentioned this pull request Oct 24, 2024

Tracking issue for release notes of #129248: Taking a raw ref (&raw (const|mut)) of a deref of pointer (*ptr) is always safe #132100

Closed

3 tasks

bors merged commit 93bf791 into rust-lang:master Oct 24, 2024
6 checks passed

rustbot added this to the 1.84.0 milestone Oct 24, 2024

Veykril mentioned this pull request Dec 18, 2024

Taking a raw ref of a deref is always safe rust-lang/rust-analyzer#18711

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Taking a raw ref (`&raw (const|mut)`) of a deref of pointer (`*ptr`) is always safe #129248

Taking a raw ref (`&raw (const|mut)`) of a deref of pointer (`*ptr`) is always safe #129248

compiler-errors commented Aug 18, 2024

rustbot commented Aug 18, 2024

RalfJung commented Aug 18, 2024

compiler-errors commented Aug 18, 2024

nnethercote commented Aug 18, 2024

scottmcm commented Aug 21, 2024

traviscross commented Aug 21, 2024

bors commented Aug 21, 2024

compiler-errors commented Aug 21, 2024

traviscross commented Aug 21, 2024

This comment has been minimized.

workingjubilee commented Aug 22, 2024

RalfJung commented Aug 22, 2024

RalfJung commented Aug 22, 2024

compiler-errors commented Aug 22, 2024

bors commented Sep 15, 2024

compiler-errors commented Oct 7, 2024

scottmcm commented Oct 7, 2024

compiler-errors commented Oct 7, 2024 •

edited

Loading

compiler-errors commented Oct 11, 2024

nnethercote commented Oct 11, 2024

RalfJung commented Oct 12, 2024

nnethercote commented Oct 24, 2024

bors commented Oct 24, 2024

Taking a raw ref (&raw (const|mut)) of a deref of pointer (*ptr) is always safe #129248

Taking a raw ref (&raw (const|mut)) of a deref of pointer (*ptr) is always safe #129248

Conversation

compiler-errors commented Aug 18, 2024

rustbot commented Aug 18, 2024

RalfJung commented Aug 18, 2024

compiler-errors commented Aug 18, 2024

nnethercote commented Aug 18, 2024

scottmcm commented Aug 21, 2024

traviscross commented Aug 21, 2024

bors commented Aug 21, 2024

compiler-errors commented Aug 21, 2024

traviscross commented Aug 21, 2024

This comment has been minimized.

workingjubilee commented Aug 22, 2024

RalfJung commented Aug 22, 2024

RalfJung commented Aug 22, 2024

compiler-errors commented Aug 22, 2024

bors commented Sep 15, 2024

compiler-errors commented Oct 7, 2024

scottmcm commented Oct 7, 2024

compiler-errors commented Oct 7, 2024 • edited Loading

compiler-errors commented Oct 11, 2024

nnethercote commented Oct 11, 2024

RalfJung commented Oct 12, 2024

nnethercote commented Oct 24, 2024

bors commented Oct 24, 2024

Taking a raw ref (`&raw (const|mut)`) of a deref of pointer (`*ptr`) is always safe #129248

Taking a raw ref (`&raw (const|mut)`) of a deref of pointer (`*ptr`) is always safe #129248

compiler-errors commented Oct 7, 2024 •

edited

Loading