-
-
Notifications
You must be signed in to change notification settings - Fork 15k
ref pin mut pattern unsoundly allows pin-projecting arbitrary types #157634
Copy link
Copy link
Closed
Labels
A-patternsRelating to patterns and pattern matchingRelating to patterns and pattern matchingA-pinArea: PinArea: PinC-bugCategory: This is a bug.Category: This is a bug.F-pin_ergonomics`#![feature(pin_ergonomics)]``#![feature(pin_ergonomics)]`I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.Relevant to the compiler team, which will review and decide on the PR/issue.
Metadata
Metadata
Assignees
Labels
A-patternsRelating to patterns and pattern matchingRelating to patterns and pattern matchingA-pinArea: PinArea: PinC-bugCategory: This is a bug.Category: This is a bug.F-pin_ergonomics`#![feature(pin_ergonomics)]``#![feature(pin_ergonomics)]`I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessT-compilerRelevant to the compiler team, which will review and decide on the PR/issue.Relevant to the compiler team, which will review and decide on the PR/issue.
Type
Fields
Give feedbackNo fields configured for issues without a type.
Projects
StatusShow more project fields
No status
@Dnreikronos discovered in #157615 that, while the
pin_ergonomicsfeature allows implicit pin projections (via binding mode stuff) only on#[pin_v2]types, it allows explicit pin projections withref pin mutpatterns on any type. I think this is incorrect.This pin projection can be done even on types that shouldn't be structurally pinned. This is unsound, as the code below demonstrates by breaking the
Pinguarantee.Output:
The
Thingtype unconditionally implementsUnpin. This implies that the type should not be structurally pinned. The code then uses this to pin a non-Unpintype at one memory address, then later move that type to a different memory address, which breaks thePinguarantee.Note that async-await currently does not work with
pin_ergonomics, due to #153733. If it did, it would be possible to use this guarantee-breaking to directly cause UB in safe code with async-await.Meta
Reproducible on the playground with version
1.98.0-nightly (2026-06-07 f20a92ec01483dc5c58e)