Skip to content

Fix repr(packed) drop UBs - #165010

Open
Jules-Bertholet wants to merge 3 commits into
rust-lang:mainfrom
Jules-Bertholet:repr-pack-box-drop-move
Open

Jules-Bertholet wants to merge 3 commits into
rust-lang:mainfrom
Jules-Bertholet:repr-pack-box-drop-move

Conversation

@Jules-Bertholet

@Jules-Bertholet Jules-Bertholet commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

Fixes #143411, fixes #164561.

This also replaces the UnwrapUnsafeBinder MIR projection with a more general Transmute projection. I'm not sure if there is anything extra I need to implement for that, e.g. for Miri checks.

@rustbot label A-destructors A-MIR A-repr-packed

@rustbot

rustbot commented Oct 27, 2026

Copy link
Copy Markdown
Collaborator

rustc_codegen_cranelift is developed in its own repository. If possible, consider making this change to rust-lang/rustc_codegen_cranelift instead.

cc @bjorn3

miri is developed in its own repository. If the Miri part of this change can be broken out, consider making this change to rust-lang/miri instead. However, if Miri needs adjusting for rustc changes, just ignore this message.

cc @rust-lang/miri

Some changes occurred to the CTFE machinery

cc @RalfJung, @oli-obk, @lcnr

Some changes occurred to MIR optimizations

cc @rust-lang/wg-mir-opt

Some changes occurred to constck

cc @fee1-dead

This PR changes MIR

cc @oli-obk, @RalfJung, @JakobDegen, @vakaras

This PR changes rustc_public

cc @oli-obk, @celinval, @ouz-a, @makai410

Some changes occurred to the CTFE / Miri interpreter

cc @rust-lang/miri

clippy is developed in its own repository. If possible, consider making this change to rust-lang/rust-clippy instead.

cc @rust-lang/clippy

@rustbot rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-clippy Relevant to the Clippy team. T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. labels Oct 27, 2026
@rustbot

rustbot commented Oct 27, 2026

Copy link
Copy Markdown
Collaborator

r? @JohnTitor

rustbot has assigned @JohnTitor.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

  • Owners of files modified in this PR: compiler, mir, mir-opt
  • compiler, mir, mir-opt expanded to 77 candidates
  • Random selection from 22 candidates

@rustbot rustbot added A-destructors Area: Destructors (`Drop`, …) A-MIR Area: Mid-level IR (MIR) - https://blog.rust-lang.org/2016/04/19/MIR.html A-repr-packed Area: the naughtiest repr labels Oct 27, 2026
@Jules-Bertholet
Jules-Bertholet force-pushed the repr-pack-box-drop-move branch from 46bcae7 to 28ef878 Compare October 27, 2026 01:00
@rust-log-analyzer

This comment has been minimized.

@Jules-Bertholet
Jules-Bertholet force-pushed the repr-pack-box-drop-move branch from 28ef878 to 9c76242 Compare October 27, 2026 03:00
@theemathas

This comment has been minimized.

@Jules-Bertholet Jules-Bertholet changed the title Fix UB when dropping packed ADT with Box field Fix UB when dropping packed ADT with dangling reference field Oct 27, 2026
@Jules-Bertholet Jules-Bertholet changed the title Fix UB when dropping packed ADT with dangling reference field Fix UB when dropping packed ADT with dangling field Oct 27, 2026
@Jules-Bertholet Jules-Bertholet changed the title Fix UB when dropping packed ADT with dangling field Fix repr(packed) drop UBs Oct 27, 2026
@Jules-Bertholet
Jules-Bertholet force-pushed the repr-pack-box-drop-move branch 2 times, most recently from 9b352df to dfca5fb Compare October 27, 2026 05:35
UnwrapUnsafeBinder(T),
/// Transmute the type of the place. This is a projection of a place,
/// so it doesn't necessarily constitute a move out of the source type.
/// Used for unsafe binders, among other things.

@RalfJung RalfJung Oct 27, 2026 •

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"transmute on a place" is an interesting operation. This is basically transmuting a pointer.

Which constraints does it have? Probably none on the actual value, that will be checked only if the place is actually loaded-from. But I assume the old and new type both have to be sized? Or at least, they must have the same metadata type. Otherwise, it's unclear where the metadata should come from.

View changes since the review

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, they both need to be Sized, that is checked in validate.

span_bug!(self.cur_span(), "PhantomDeref encountered after borrowck")
}
UnwrapUnsafeBinder(target) => base.transmute(self.layout_of(target)?, self)?,
Transmute(target) => base.transmute(self.layout_of(target)?, self)?,

@RalfJung RalfJung Oct 27, 2026 •

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will check that base and target have the same size. If that's a constraint we want to impose, it should be mentioned in the MIR syntax docs.

View changes since the review

Comment on lines +1233 to +1234
if util::place_unalignment_2(tcx, self.elaborator.typing_env(), self.place, |place| {
self.place_ref_ty(place)

@RalfJung RalfJung Oct 27, 2026 •

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That function name surely is something.^^

Why do we not have a LocalDecls here?

View changes since the review

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because the locals are split between the MIR body, and the MIR patch we are still building up and haven't applied to it yet.

Comment thread compiler/rustc_middle/src/mir/syntax.rs Resolved
@JohnTitor

Copy link
Copy Markdown
Member

@rustbot reroll

@rustbot rustbot assigned wesleywiser and unassigned JohnTitor Nov 3, 2026
@rust-bors

This comment has been minimized.

@rustbot

rustbot commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-destructors Area: Destructors (`Drop`, …) A-MIR Area: Mid-level IR (MIR) - https://blog.rust-lang.org/2016/04/19/MIR.html A-repr-packed Area: the naughtiest repr S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-clippy Relevant to the Clippy team. T-compiler Relevant to the compiler team, which will review and decide on the PR/issue.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

moving a Box out of a packed struct creates a misaligned &mut Box to drop it Destructor of packed structs can move dangling references.

7 participants