Skip to content

Conversation

Urgau
Copy link
Member

@Urgau Urgau commented Jul 27, 2025

integer_to_ptr_transmutes

warn-by-default

The integer_to_ptr_transmutes lint detects integer to pointer transmutes where the resulting pointers are undefined behavior to dereference.

Example

fn foo(a: usize) -> *const u8 {
    unsafe {
        std::mem::transmute::<usize, *const u8>(a)
    }
}
warning: transmuting an integer to a pointer creates a pointer without provenance
   --> a.rs:1:9
    |
158 |         std::mem::transmute::<usize, *const u8>(a)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
    = note: this is dangerous because dereferencing the resulting pointer is undefined behavior
    = note: exposed provenance semantics can be used to create a pointer based on some previously exposed provenance
    = help: if you truly mean to create a pointer without provenance, use `std::ptr::without_provenance_mut`
    = help: for more information about transmute, see <https://doc.rust-lang.org/std/mem/fn.transmute.html#transmutation-between-pointers-and-integers>
    = help: for more information about exposed provenance, see <https://doc.rust-lang.org/std/ptr/index.html#exposed-provenance>
    = note: `#[warn(integer_to_ptr_transmutes)]` on by default
help: use `std::ptr::with_exposed_provenance` instead to use a previously exposed provenance
    |
158 -     std::mem::transmute::<usize, *const u8>(a)
158 +     std::ptr::with_exposed_provenance::<u8>(a)
    |

Explanation

Any attempt to use the resulting pointers are undefined behavior as the resulting pointers won't have any provenance.

Alternatively, std::ptr::with_exposed_provenance should be used, as they do not carry the provenance requirement or if the wanting to create pointers without provenance std::ptr::without_provenance_mut should be used.

See std::mem::transmute in the reference for more details.


People are getting tripped up on this, see #128409 and #141220. There are >90 cases like these on GitHub search.

Fixes rust-lang/rust-clippy#13140
Fixes #141220
Fixes #145523

@rustbot labels +I-lang-nominated +T-lang
cc @traviscross
r? compiler

@rustbot rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Jul 27, 2025
@rustbot
Copy link
Collaborator

rustbot commented Jul 27, 2025

The Miri subtree was changed

cc @rust-lang/miri

@rustbot rustbot added I-lang-nominated Nominated for discussion during a lang team meeting. T-lang Relevant to the language team labels Jul 27, 2025
@RalfJung
Copy link
Member

for more information about exposed provenance

This is confusing since exposed provenance is not previously mentioned in the error message.

use std::ptr::without_provenance_mut to create a pointer without provenance

The error should probably make it clear that int-to-ptr transmute also create a pointer without provenance.

@rust-log-analyzer

This comment has been minimized.

@Urgau Urgau force-pushed the int_to_ptr_transmutes branch from b8f46d7 to 950af22 Compare July 27, 2025 13:08
@Urgau
Copy link
Member Author

Urgau commented Jul 27, 2025

I have adjusted the diagnostics to make it clear that int-to-ptr transmute also create a pointer without transmute and added a note about exposed provenance (since suggestions always go at the end).

@Urgau Urgau force-pushed the int_to_ptr_transmutes branch from 950af22 to 66d7c24 Compare July 27, 2025 13:38
Comment on lines +20 to +42
unsafe fn should_not_lint(a: usize) {
let _ptr = unsafe { std::mem::transmute::<usize, *const u8>(0usize) }; // linted by other lints
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the other lint? I'm not immediately seeing another diagnostic in testing.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(We have deref-nullptr, but that fires when dereferencing it.)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For references, we lint on transmutes with the 0 literal with the invalid_value lint:

warning: the type `&i32` does not permit zero-initialization
 --> src/lib.rs:2:39
  |
2 |     let _val: &'static i32 = unsafe { std::mem::transmute(0usize) };
  |                                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  |                                       |
  |                                       this code causes undefined behavior when executed
  |                                       help: use `MaybeUninit<T>` instead, and only call `assume_init` after initialization is done
  |
  = note: references must be non-null
  = note: `#[warn(invalid_value)]` on by default

For pointer we lint on some function with the invalid_null_arguments lint:

error: calling this function with a null pointer is undefined behavior, even if the result of the function is unused
  --> /home/archie/Projects/RustProjects/rust/tests/ui/lint/invalid_null_args.rs:27:23
   |
LL |     let _: &[usize] = std::slice::from_raw_parts(mem::transmute(0usize), 0);
   |                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^------^^^^^
   |                                                                 |
   |                                                                 null pointer originates from here
   |
   = help: for more information, visit <https://doc.rust-lang.org/std/ptr/index.html> and <https://doc.rust-lang.org/reference/behavior-considered-undefined.html>

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could not care about the invalid_null_arguments lint and lint on transmutes to raw pointer.

For references I think we should keep it under the invalid_value lint.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like nobody will be surprised that transmuting 0 to a pointer will not give you something you can dereference...

Copy link
Member

@samueltardieu samueltardieu Jul 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Even in the context of #141260? (I haven't checked carefully, it just rang a bell)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For out-of-AM volatile accesses, provenance does not matter.

@traviscross traviscross added P-lang-drag-1 Lang team prioritization drag level 1. https://rust-lang.zulipchat.com/#narrow/channel/410516-t-lang and removed T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Jul 27, 2025
@rust-log-analyzer

This comment has been minimized.

@Urgau Urgau force-pushed the int_to_ptr_transmutes branch 2 times, most recently from f29459b to a2f8fde Compare July 27, 2025 16:17
@rust-log-analyzer

This comment has been minimized.

@Urgau Urgau force-pushed the int_to_ptr_transmutes branch from a2f8fde to eec7ccb Compare July 27, 2025 19:35
@rustbot rustbot added the T-clippy Relevant to the Clippy team. label Jul 27, 2025
@rustbot
Copy link
Collaborator

rustbot commented Jul 27, 2025

Some changes occurred in src/tools/clippy

cc @rust-lang/clippy

@Urgau Urgau removed the T-clippy Relevant to the Clippy team. label Jul 27, 2025
@blyxyas blyxyas added T-lang Relevant to the language team and removed T-lang Relevant to the language team labels Jul 27, 2025
@rust-log-analyzer

This comment has been minimized.

@Urgau Urgau force-pushed the int_to_ptr_transmutes branch from eec7ccb to 186956d Compare July 27, 2025 21:07
@bors
Copy link
Collaborator

bors commented Aug 24, 2025

⌛ Testing commit 1da4959 with merge ddbb4bb...

bors added a commit that referenced this pull request Aug 24, 2025
Add lint against integer to pointer transmutes

# `integer_to_ptr_transmutes`

*warn-by-default*

The `integer_to_ptr_transmutes` lint detects integer to pointer transmutes where the resulting pointers are undefined behavior to dereference.

### Example

```rust
fn foo(a: usize) -> *const u8 {
    unsafe {
        std::mem::transmute::<usize, *const u8>(a)
    }
}
```

```
warning: transmuting an integer to a pointer creates a pointer without provenance
   --> a.rs:1:9
    |
158 |         std::mem::transmute::<usize, *const u8>(a)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
    = note: this is dangerous because dereferencing the resulting pointer is undefined behavior
    = note: exposed provenance semantics can be used to create a pointer based on some previously exposed provenance
    = help: if you truly mean to create a pointer without provenance, use `std::ptr::without_provenance_mut`
    = help: for more information about transmute, see <https://doc.rust-lang.org/std/mem/fn.transmute.html#transmutation-between-pointers-and-integers>
    = help: for more information about exposed provenance, see <https://doc.rust-lang.org/std/ptr/index.html#exposed-provenance>
    = note: `#[warn(integer_to_ptr_transmutes)]` on by default
help: use `std::ptr::with_exposed_provenance` instead to use a previously exposed provenance
    |
158 -     std::mem::transmute::<usize, *const u8>(a)
158 +     std::ptr::with_exposed_provenance::<u8>(a)
    |
```

### Explanation

Any attempt to use the resulting pointers are undefined behavior as the resulting pointers won't have any provenance.

Alternatively, `std::ptr::with_exposed_provenance` should be used, as they do not carry the provenance requirement or if the wanting to create pointers without provenance `std::ptr::without_provenance_mut` should be used.

See [std::mem::transmute] in the reference for more details.

[std::mem::transmute]: https://doc.rust-lang.org/std/mem/fn.transmute.html

--------

People are getting tripped up on this, see #128409 and #141220. There are >90 cases like these on [GitHub search](https://github.com/search?q=lang%3Arust+%2Ftransmute%3A%3A%3Cu%5B0-9%5D*.*%2C+%5C*const%2F&type=code).

Fixes rust-lang/rust-clippy#13140
Fixes #141220
Fixes #145523

`@rustbot` labels +I-lang-nominated +T-lang
cc `@traviscross`
r? compiler
Zalathar added a commit to Zalathar/rust that referenced this pull request Aug 24, 2025
…kh726

Add lint against integer to pointer transmutes

# `integer_to_ptr_transmutes`

*warn-by-default*

The `integer_to_ptr_transmutes` lint detects integer to pointer transmutes where the resulting pointers are undefined behavior to dereference.

### Example

```rust
fn foo(a: usize) -> *const u8 {
    unsafe {
        std::mem::transmute::<usize, *const u8>(a)
    }
}
```

```
warning: transmuting an integer to a pointer creates a pointer without provenance
   --> a.rs:1:9
    |
158 |         std::mem::transmute::<usize, *const u8>(a)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
    = note: this is dangerous because dereferencing the resulting pointer is undefined behavior
    = note: exposed provenance semantics can be used to create a pointer based on some previously exposed provenance
    = help: if you truly mean to create a pointer without provenance, use `std::ptr::without_provenance_mut`
    = help: for more information about transmute, see <https://doc.rust-lang.org/std/mem/fn.transmute.html#transmutation-between-pointers-and-integers>
    = help: for more information about exposed provenance, see <https://doc.rust-lang.org/std/ptr/index.html#exposed-provenance>
    = note: `#[warn(integer_to_ptr_transmutes)]` on by default
help: use `std::ptr::with_exposed_provenance` instead to use a previously exposed provenance
    |
158 -     std::mem::transmute::<usize, *const u8>(a)
158 +     std::ptr::with_exposed_provenance::<u8>(a)
    |
```

### Explanation

Any attempt to use the resulting pointers are undefined behavior as the resulting pointers won't have any provenance.

Alternatively, `std::ptr::with_exposed_provenance` should be used, as they do not carry the provenance requirement or if the wanting to create pointers without provenance `std::ptr::without_provenance_mut` should be used.

See [std::mem::transmute] in the reference for more details.

[std::mem::transmute]: https://doc.rust-lang.org/std/mem/fn.transmute.html

--------

People are getting tripped up on this, see rust-lang#128409 and rust-lang#141220. There are >90 cases like these on [GitHub search](https://github.com/search?q=lang%3Arust+%2Ftransmute%3A%3A%3Cu%5B0-9%5D*.*%2C+%5C*const%2F&type=code).

Fixes rust-lang/rust-clippy#13140
Fixes rust-lang#141220
Fixes rust-lang#145523

``@rustbot`` labels +I-lang-nominated +T-lang
cc ``@traviscross``
r? compiler
Zalathar added a commit to Zalathar/rust that referenced this pull request Aug 24, 2025
…kh726

Add lint against integer to pointer transmutes

# `integer_to_ptr_transmutes`

*warn-by-default*

The `integer_to_ptr_transmutes` lint detects integer to pointer transmutes where the resulting pointers are undefined behavior to dereference.

### Example

```rust
fn foo(a: usize) -> *const u8 {
    unsafe {
        std::mem::transmute::<usize, *const u8>(a)
    }
}
```

```
warning: transmuting an integer to a pointer creates a pointer without provenance
   --> a.rs:1:9
    |
158 |         std::mem::transmute::<usize, *const u8>(a)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
    = note: this is dangerous because dereferencing the resulting pointer is undefined behavior
    = note: exposed provenance semantics can be used to create a pointer based on some previously exposed provenance
    = help: if you truly mean to create a pointer without provenance, use `std::ptr::without_provenance_mut`
    = help: for more information about transmute, see <https://doc.rust-lang.org/std/mem/fn.transmute.html#transmutation-between-pointers-and-integers>
    = help: for more information about exposed provenance, see <https://doc.rust-lang.org/std/ptr/index.html#exposed-provenance>
    = note: `#[warn(integer_to_ptr_transmutes)]` on by default
help: use `std::ptr::with_exposed_provenance` instead to use a previously exposed provenance
    |
158 -     std::mem::transmute::<usize, *const u8>(a)
158 +     std::ptr::with_exposed_provenance::<u8>(a)
    |
```

### Explanation

Any attempt to use the resulting pointers are undefined behavior as the resulting pointers won't have any provenance.

Alternatively, `std::ptr::with_exposed_provenance` should be used, as they do not carry the provenance requirement or if the wanting to create pointers without provenance `std::ptr::without_provenance_mut` should be used.

See [std::mem::transmute] in the reference for more details.

[std::mem::transmute]: https://doc.rust-lang.org/std/mem/fn.transmute.html

--------

People are getting tripped up on this, see rust-lang#128409 and rust-lang#141220. There are >90 cases like these on [GitHub search](https://github.com/search?q=lang%3Arust+%2Ftransmute%3A%3A%3Cu%5B0-9%5D*.*%2C+%5C*const%2F&type=code).

Fixes rust-lang/rust-clippy#13140
Fixes rust-lang#141220
Fixes rust-lang#145523

```@rustbot``` labels +I-lang-nominated +T-lang
cc ```@traviscross```
r? compiler
bors added a commit that referenced this pull request Aug 24, 2025
Add lint against integer to pointer transmutes

# `integer_to_ptr_transmutes`

*warn-by-default*

The `integer_to_ptr_transmutes` lint detects integer to pointer transmutes where the resulting pointers are undefined behavior to dereference.

### Example

```rust
fn foo(a: usize) -> *const u8 {
    unsafe {
        std::mem::transmute::<usize, *const u8>(a)
    }
}
```

```
warning: transmuting an integer to a pointer creates a pointer without provenance
   --> a.rs:1:9
    |
158 |         std::mem::transmute::<usize, *const u8>(a)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
    = note: this is dangerous because dereferencing the resulting pointer is undefined behavior
    = note: exposed provenance semantics can be used to create a pointer based on some previously exposed provenance
    = help: if you truly mean to create a pointer without provenance, use `std::ptr::without_provenance_mut`
    = help: for more information about transmute, see <https://doc.rust-lang.org/std/mem/fn.transmute.html#transmutation-between-pointers-and-integers>
    = help: for more information about exposed provenance, see <https://doc.rust-lang.org/std/ptr/index.html#exposed-provenance>
    = note: `#[warn(integer_to_ptr_transmutes)]` on by default
help: use `std::ptr::with_exposed_provenance` instead to use a previously exposed provenance
    |
158 -     std::mem::transmute::<usize, *const u8>(a)
158 +     std::ptr::with_exposed_provenance::<u8>(a)
    |
```

### Explanation

Any attempt to use the resulting pointers are undefined behavior as the resulting pointers won't have any provenance.

Alternatively, `std::ptr::with_exposed_provenance` should be used, as they do not carry the provenance requirement or if the wanting to create pointers without provenance `std::ptr::without_provenance_mut` should be used.

See [std::mem::transmute] in the reference for more details.

[std::mem::transmute]: https://doc.rust-lang.org/std/mem/fn.transmute.html

--------

People are getting tripped up on this, see #128409 and #141220. There are >90 cases like these on [GitHub search](https://github.com/search?q=lang%3Arust+%2Ftransmute%3A%3A%3Cu%5B0-9%5D*.*%2C+%5C*const%2F&type=code).

Fixes rust-lang/rust-clippy#13140
Fixes #141220
Fixes #145523

`@rustbot` labels +I-lang-nominated +T-lang
cc `@traviscross`
r? compiler
@bors
Copy link
Collaborator

bors commented Aug 24, 2025

⌛ Testing commit 1da4959 with merge 6e1bd52...

@Zalathar
Copy link
Contributor

Yield to enclosing rollup.

@bors retry

bors added a commit that referenced this pull request Aug 24, 2025
Rollup of 6 pull requests

Successful merges:

 - #144531 (Add lint against integer to pointer transmutes)
 - #144885 (Implement some more checks in `ptr_guaranteed_cmp`. )
 - #145307 (Fix `LazyLock` poison panic message)
 - #145554 (rustc-dev-guide subtree update)
 - #145798 (Use unnamed lifetime spans as primary spans for `MISMATCHED_LIFETIME_SYNTAXES`)
 - #145799 (std/src/lib.rs: mention "search button" instead of "search bar")

r? `@ghost`
`@rustbot` modify labels: rollup
@bors
Copy link
Collaborator

bors commented Aug 24, 2025

⌛ Testing commit 1da4959 with merge a9baaf1...

bors added a commit that referenced this pull request Aug 24, 2025
Add lint against integer to pointer transmutes

# `integer_to_ptr_transmutes`

*warn-by-default*

The `integer_to_ptr_transmutes` lint detects integer to pointer transmutes where the resulting pointers are undefined behavior to dereference.

### Example

```rust
fn foo(a: usize) -> *const u8 {
    unsafe {
        std::mem::transmute::<usize, *const u8>(a)
    }
}
```

```
warning: transmuting an integer to a pointer creates a pointer without provenance
   --> a.rs:1:9
    |
158 |         std::mem::transmute::<usize, *const u8>(a)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
    = note: this is dangerous because dereferencing the resulting pointer is undefined behavior
    = note: exposed provenance semantics can be used to create a pointer based on some previously exposed provenance
    = help: if you truly mean to create a pointer without provenance, use `std::ptr::without_provenance_mut`
    = help: for more information about transmute, see <https://doc.rust-lang.org/std/mem/fn.transmute.html#transmutation-between-pointers-and-integers>
    = help: for more information about exposed provenance, see <https://doc.rust-lang.org/std/ptr/index.html#exposed-provenance>
    = note: `#[warn(integer_to_ptr_transmutes)]` on by default
help: use `std::ptr::with_exposed_provenance` instead to use a previously exposed provenance
    |
158 -     std::mem::transmute::<usize, *const u8>(a)
158 +     std::ptr::with_exposed_provenance::<u8>(a)
    |
```

### Explanation

Any attempt to use the resulting pointers are undefined behavior as the resulting pointers won't have any provenance.

Alternatively, `std::ptr::with_exposed_provenance` should be used, as they do not carry the provenance requirement or if the wanting to create pointers without provenance `std::ptr::without_provenance_mut` should be used.

See [std::mem::transmute] in the reference for more details.

[std::mem::transmute]: https://doc.rust-lang.org/std/mem/fn.transmute.html

--------

People are getting tripped up on this, see #128409 and #141220. There are >90 cases like these on [GitHub search](https://github.com/search?q=lang%3Arust+%2Ftransmute%3A%3A%3Cu%5B0-9%5D*.*%2C+%5C*const%2F&type=code).

Fixes rust-lang/rust-clippy#13140
Fixes #141220
Fixes #145523

`@rustbot` labels +I-lang-nominated +T-lang
cc `@traviscross`
r? compiler
@jhpratt
Copy link
Member

jhpratt commented Aug 24, 2025

@bors retry

yielding to rollup that includes this PR

bors added a commit that referenced this pull request Aug 24, 2025
Rollup of 5 pull requests

Successful merges:

 - #144531 (Add lint against integer to pointer transmutes)
 - #145307 (Fix `LazyLock` poison panic message)
 - #145554 (rustc-dev-guide subtree update)
 - #145798 (Use unnamed lifetime spans as primary spans for `MISMATCHED_LIFETIME_SYNTAXES`)
 - #145799 (std/src/lib.rs: mention "search button" instead of "search bar")

r? `@ghost`
`@rustbot` modify labels: rollup
@bors bors merged commit 2655036 into rust-lang:master Aug 24, 2025
10 of 11 checks passed
@rustbot rustbot added this to the 1.91.0 milestone Aug 24, 2025
@bors
Copy link
Collaborator

bors commented Aug 24, 2025

⌛ Testing commit 1da4959 with merge 4eedad3...

rust-timer added a commit that referenced this pull request Aug 24, 2025
Rollup merge of #144531 - Urgau:int_to_ptr_transmutes, r=jackh726

Add lint against integer to pointer transmutes

# `integer_to_ptr_transmutes`

*warn-by-default*

The `integer_to_ptr_transmutes` lint detects integer to pointer transmutes where the resulting pointers are undefined behavior to dereference.

### Example

```rust
fn foo(a: usize) -> *const u8 {
    unsafe {
        std::mem::transmute::<usize, *const u8>(a)
    }
}
```

```
warning: transmuting an integer to a pointer creates a pointer without provenance
   --> a.rs:1:9
    |
158 |         std::mem::transmute::<usize, *const u8>(a)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
    = note: this is dangerous because dereferencing the resulting pointer is undefined behavior
    = note: exposed provenance semantics can be used to create a pointer based on some previously exposed provenance
    = help: if you truly mean to create a pointer without provenance, use `std::ptr::without_provenance_mut`
    = help: for more information about transmute, see <https://doc.rust-lang.org/std/mem/fn.transmute.html#transmutation-between-pointers-and-integers>
    = help: for more information about exposed provenance, see <https://doc.rust-lang.org/std/ptr/index.html#exposed-provenance>
    = note: `#[warn(integer_to_ptr_transmutes)]` on by default
help: use `std::ptr::with_exposed_provenance` instead to use a previously exposed provenance
    |
158 -     std::mem::transmute::<usize, *const u8>(a)
158 +     std::ptr::with_exposed_provenance::<u8>(a)
    |
```

### Explanation

Any attempt to use the resulting pointers are undefined behavior as the resulting pointers won't have any provenance.

Alternatively, `std::ptr::with_exposed_provenance` should be used, as they do not carry the provenance requirement or if the wanting to create pointers without provenance `std::ptr::without_provenance_mut` should be used.

See [std::mem::transmute] in the reference for more details.

[std::mem::transmute]: https://doc.rust-lang.org/std/mem/fn.transmute.html

--------

People are getting tripped up on this, see #128409 and #141220. There are >90 cases like these on [GitHub search](https://github.com/search?q=lang%3Arust+%2Ftransmute%3A%3A%3Cu%5B0-9%5D*.*%2C+%5C*const%2F&type=code).

Fixes rust-lang/rust-clippy#13140
Fixes #141220
Fixes #145523

`@rustbot` labels +I-lang-nominated +T-lang
cc `@traviscross`
r? compiler
@jhpratt
Copy link
Member

jhpratt commented Aug 24, 2025

still in queue

@bors r-

@jhpratt
Copy link
Member

jhpratt commented Aug 24, 2025

@bors r- retry

@bors bors added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Aug 24, 2025
github-actions bot pushed a commit to rust-lang/rustc-dev-guide that referenced this pull request Aug 25, 2025
Rollup of 5 pull requests

Successful merges:

 - rust-lang/rust#144531 (Add lint against integer to pointer transmutes)
 - rust-lang/rust#145307 (Fix `LazyLock` poison panic message)
 - rust-lang/rust#145554 (rustc-dev-guide subtree update)
 - rust-lang/rust#145798 (Use unnamed lifetime spans as primary spans for `MISMATCHED_LIFETIME_SYNTAXES`)
 - rust-lang/rust#145799 (std/src/lib.rs: mention "search button" instead of "search bar")

r? `@ghost`
`@rustbot` modify labels: rollup
github-actions bot pushed a commit to rust-lang/miri that referenced this pull request Aug 25, 2025
Rollup of 5 pull requests

Successful merges:

 - rust-lang/rust#144531 (Add lint against integer to pointer transmutes)
 - rust-lang/rust#145307 (Fix `LazyLock` poison panic message)
 - rust-lang/rust#145554 (rustc-dev-guide subtree update)
 - rust-lang/rust#145798 (Use unnamed lifetime spans as primary spans for `MISMATCHED_LIFETIME_SYNTAXES`)
 - rust-lang/rust#145799 (std/src/lib.rs: mention "search button" instead of "search bar")

r? `@ghost`
`@rustbot` modify labels: rollup
github-actions bot pushed a commit to model-checking/verify-rust-std that referenced this pull request Aug 26, 2025
…kh726

Add lint against integer to pointer transmutes

# `integer_to_ptr_transmutes`

*warn-by-default*

The `integer_to_ptr_transmutes` lint detects integer to pointer transmutes where the resulting pointers are undefined behavior to dereference.

### Example

```rust
fn foo(a: usize) -> *const u8 {
    unsafe {
        std::mem::transmute::<usize, *const u8>(a)
    }
}
```

```
warning: transmuting an integer to a pointer creates a pointer without provenance
   --> a.rs:1:9
    |
158 |         std::mem::transmute::<usize, *const u8>(a)
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
    = note: this is dangerous because dereferencing the resulting pointer is undefined behavior
    = note: exposed provenance semantics can be used to create a pointer based on some previously exposed provenance
    = help: if you truly mean to create a pointer without provenance, use `std::ptr::without_provenance_mut`
    = help: for more information about transmute, see <https://doc.rust-lang.org/std/mem/fn.transmute.html#transmutation-between-pointers-and-integers>
    = help: for more information about exposed provenance, see <https://doc.rust-lang.org/std/ptr/index.html#exposed-provenance>
    = note: `#[warn(integer_to_ptr_transmutes)]` on by default
help: use `std::ptr::with_exposed_provenance` instead to use a previously exposed provenance
    |
158 -     std::mem::transmute::<usize, *const u8>(a)
158 +     std::ptr::with_exposed_provenance::<u8>(a)
    |
```

### Explanation

Any attempt to use the resulting pointers are undefined behavior as the resulting pointers won't have any provenance.

Alternatively, `std::ptr::with_exposed_provenance` should be used, as they do not carry the provenance requirement or if the wanting to create pointers without provenance `std::ptr::without_provenance_mut` should be used.

See [std::mem::transmute] in the reference for more details.

[std::mem::transmute]: https://doc.rust-lang.org/std/mem/fn.transmute.html

--------

People are getting tripped up on this, see rust-lang#128409 and rust-lang#141220. There are >90 cases like these on [GitHub search](https://github.com/search?q=lang%3Arust+%2Ftransmute%3A%3A%3Cu%5B0-9%5D*.*%2C+%5C*const%2F&type=code).

Fixes rust-lang/rust-clippy#13140
Fixes rust-lang#141220
Fixes rust-lang#145523

`@rustbot` labels +I-lang-nominated +T-lang
cc `@traviscross`
r? compiler
@apiraino apiraino removed the to-announce Announce this issue on triage meeting label Aug 28, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
disposition-merge This issue / PR is in PFCP or FCP with a disposition to merge it. finished-final-comment-period The final comment period is finished for this PR / Issue. I-lang-radar Items that are on lang's radar and will need eventual work or consideration. S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. T-clippy Relevant to the Clippy team. T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. T-lang Relevant to the language team
Projects
None yet