Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Ptr inconsistency in {Rc,Arc} #138303

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Conversation

DiuDiu777
Copy link
Contributor

PR Description

This pr aims to address the problem discussed on zulip.

Problem Clarification

As this post presents, the {Rc, Arc}::{in/de-crement_strong_count_/in} do not limit the layout of the memory that ptr points to, while internally Rc::from_raw_in is called directly.

UB doesn't just appear when the strong count is decremented to zero. Miri also detects the UB of out-of-bounds pointer use when increment strong count is called on a pointer with an incorrect layout(shown as below).

use std::rc::Rc;
#[repr(align(8))]
struct Aligned8(u64);

#[repr(align(16))]
struct Aligned16(u64);

fn main() {
    let rc: Rc<Aligned8> = Rc::new(Aligned8(42));
    let raw_ptr = Rc::into_raw(rc);

    unsafe {
        Rc::increment_strong_count(raw_ptr as *const Aligned16);
    }
}

Miri output:

error: Undefined Behavior: out-of-bounds pointer use: expected a pointer to 32 bytes of memory, but got alloc954 which is only 24 bytes from the end of the allocation

@rustbot
Copy link
Collaborator

rustbot commented Mar 10, 2025

r? @Mark-Simulacrum

rustbot has assigned @Mark-Simulacrum.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

@rustbot rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Mar 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants