Add as_ptr_cast_mut lint
#9572
Add as_ptr_cast_mut lint
#9572
Conversation
|
r? @dswij (rust-highfive has picked a reviewer for you, use r? to override) |
rust-highfive
added
the
S-waiting-on-review
This lint detects calls to a `&self`-taking `as_ptr` method, where the result is then immediately cast to a `*mut T`. Code like this is probably invalid, as that pointer will not have write permissions, and `*mut T` is usually used to write through.
Noratrieb
force-pushed
the
as-ptr-cast-mut
branch
from
5f69728 to
b91dc03
Compare
clippy_lints/src/casts/mod.rs
Outdated
| /// Checks for the result of a `&self`-taking `as_ptr` being cast to a mutable pointer | ||
| /// | ||
| /// ### Why is this bad? | ||
| /// Since `as_ptr` took a `&self`, the pointer won't have write permissions, making it |
There was a problem hiding this comment.
Won't is a bit too strong. This is not a dangerous pattern if the pointer points into an UnsafeCell.
I don't know how technically correct or detailed clippy docs are expected to be, but this should not be so absolute.
There was a problem hiding this comment.
I've added a unless interior mutability is used which makes this correct, but it doesn't sound great in my opinion.
There was a problem hiding this comment.
Perhaps
/// Since `as_ptr` takes a `&self`, the pointer won't have write permissions unless interior
/// mutability is used. If this cast to `*mut` exists to enable mutation through this pointer,
/// that mutation is likely to be UB.
a79a520 to
169ef78
Compare
Noratrieb
force-pushed
the
as-ptr-cast-mut
branch
from
5ceb82c to
2b944d0
Compare
| // `as_mut_ptr` might not exist | ||
| let applicability = Applicability::MaybeIncorrect; |
There was a problem hiding this comment.
I think we can check if it implements as_mut_ptr for the suggestion, but this can be a future improvement
|
Thanks for this @Nilstrieb! @bors r+ |
|
☀️ Test successful - checks-action_dev_test, checks-action_remark_test, checks-action_test |
This lint detects calls to a
&self-takingas_ptrmethod, where the result is then immediately cast to a*mut T. Code like this is probably invalid, as that pointer will not have write permissions, and*mut Tis usually used to write through.Examples of broken code with this pattern:
https://miri.saethlin.dev/ub?crate=lol_alloc&version=0.1.3
https://miri.saethlin.dev/ub?crate=sophon-wasm&version=0.19.0
https://miri.saethlin.dev/ub?crate=polars-core&version=0.24.2
https://miri.saethlin.dev/ub?crate=ach-cell&version=0.1.17
changelog: Add [
as_ptr_cast_mut]