Lint on reference casting to bigger layout

Author: Urgau

compiler/rustc_lint/messages.ftl

@@ -319,6 +319,10 @@ lint_invalid_reference_casting_assign_to_ref = assigning to `&T` is undefined be
 lint_invalid_reference_casting_borrow_as_mut = casting `&T` to `&mut T` is undefined behavior, even if the reference is unused, consider instead using an `UnsafeCell`
     .label = casting happend here
 
+lint_invalid_reference_casting_bigger_layout = casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+    .label = casting happend here
+    .layout = casting from `{$from_ty}` (size: {$from_size} bytes, align: {$from_align} bytes) to `{$to_ty}` (size: {$to_size} bytes, align: {$to_align} bytes)
+
 lint_invalid_reference_casting_note_book = for more information, visit <https://doc.rust-lang.org/book/ch15-05-interior-mutability.html>
 
 lint_invalid_reference_casting_note_ty_has_interior_mutability = even for types with interior mutability, the only legal way to obtain a mutable pointer from a shared reference is through `UnsafeCell::get`

compiler/rustc_lint/src/lints.rs

@@ -752,7 +752,7 @@ pub enum InvalidFromUtf8Diag {
 
 // reference_casting.rs
 #[derive(LintDiagnostic)]
-pub enum InvalidReferenceCastingDiag {
+pub enum InvalidReferenceCastingDiag<'tcx> {
     #[diag(lint_invalid_reference_casting_borrow_as_mut)]
     #[note(lint_invalid_reference_casting_note_book)]
     BorrowAsMut {
@@ -769,6 +769,18 @@ pub enum InvalidReferenceCastingDiag {
         #[note(lint_invalid_reference_casting_note_ty_has_interior_mutability)]
         ty_has_interior_mutability: Option<()>,
     },
+    #[diag(lint_invalid_reference_casting_bigger_layout)]
+    #[note(lint_layout)]
+    BiggerLayout {
+        #[label]
+        orig_cast: Option<Span>,
+        from_ty: Ty<'tcx>,
+        from_size: u64,
+        from_align: u64,
+        to_ty: Ty<'tcx>,
+        to_size: u64,
+        to_align: u64,
+    },
 }
 
 // hidden_unicode_codepoints.rs

compiler/rustc_lint/src/reference_casting.rs

@@ -1,6 +1,7 @@
 use rustc_ast::Mutability;
 use rustc_hir::{Expr, ExprKind, UnOp};
-use rustc_middle::ty::{self, TypeAndMut};
+use rustc_middle::ty::layout::LayoutOf as _;
+use rustc_middle::ty::{self, layout::TyAndLayout, TypeAndMut};
 use rustc_span::sym;
 
 use crate::{lints::InvalidReferenceCastingDiag, LateContext, LateLintPass, LintContext};
@@ -38,13 +39,12 @@ declare_lint_pass!(InvalidReferenceCasting => [INVALID_REFERENCE_CASTING]);
 impl<'tcx> LateLintPass<'tcx> for InvalidReferenceCasting {
     fn check_expr(&mut self, cx: &LateContext<'tcx>, expr: &'tcx Expr<'tcx>) {
         if let Some((e, pat)) = borrow_or_assign(cx, expr) {
-            if matches!(pat, PatternKind::Borrow { mutbl: Mutability::Mut } | PatternKind::Assign) {
-                let init = cx.expr_or_init(e);
+            let init = cx.expr_or_init(e);
+            let orig_cast = if init.span != e.span { Some(init.span) } else { None };
 
-                let Some(ty_has_interior_mutability) = is_cast_from_ref_to_mut_ptr(cx, init) else {
-                    return;
-                };
-                let orig_cast = if init.span != e.span { Some(init.span) } else { None };
+            if matches!(pat, PatternKind::Borrow { mutbl: Mutability::Mut } | PatternKind::Assign)
+                && let Some(ty_has_interior_mutability) = is_cast_from_ref_to_mut_ptr(cx, init)
+            {
                 let ty_has_interior_mutability = ty_has_interior_mutability.then_some(());
 
                 cx.emit_spanned_lint(
@@ -63,6 +63,23 @@ impl<'tcx> LateLintPass<'tcx> for InvalidReferenceCasting {
                     },
                 );
             }
+
+            if let Some((from_ty_layout, to_ty_layout)) = is_cast_to_bigger_memory_layout(cx, init)
+            {
+                cx.emit_spanned_lint(
+                    INVALID_REFERENCE_CASTING,
+                    expr.span,
+                    InvalidReferenceCastingDiag::BiggerLayout {
+                        orig_cast,
+                        from_ty: from_ty_layout.ty,
+                        from_size: from_ty_layout.layout.size().bytes(),
+                        from_align: from_ty_layout.layout.align().abi.bytes(),
+                        to_ty: to_ty_layout.ty,
+                        to_size: to_ty_layout.layout.size().bytes(),
+                        to_align: to_ty_layout.layout.align().abi.bytes(),
+                    },
+                );
+            }
         }
     }
 }
@@ -151,6 +168,38 @@ fn is_cast_from_ref_to_mut_ptr<'tcx>(
     }
 }
 
+fn is_cast_to_bigger_memory_layout<'tcx>(
+    cx: &LateContext<'tcx>,
+    orig_expr: &'tcx Expr<'tcx>,
+) -> Option<(TyAndLayout<'tcx>, TyAndLayout<'tcx>)> {
+    let end_ty = cx.typeck_results().node_type(orig_expr.hir_id);
+
+    let ty::RawPtr(TypeAndMut { ty: inner_end_ty, mutbl: _ }) = end_ty.kind() else {
+        return None;
+    };
+
+    let (e, _) = peel_casts(cx, orig_expr);
+    let start_ty = cx.typeck_results().node_type(e.hir_id);
+
+    let ty::Ref(_, inner_start_ty, _) = start_ty.kind() else {
+        return None;
+    };
+
+    let (Ok(from_layout), Ok(to_layout)) =
+        (cx.layout_of(*inner_start_ty), cx.layout_of(*inner_end_ty))
+    else {
+        return None;
+    };
+
+    if to_layout.layout.size() > from_layout.layout.size()
+        || to_layout.layout.align().abi > from_layout.layout.align().abi
+    {
+        Some((from_layout, to_layout))
+    } else {
+        None
+    }
+}
+
 fn peel_casts<'tcx>(cx: &LateContext<'tcx>, mut e: &'tcx Expr<'tcx>) -> (&'tcx Expr<'tcx>, bool) {
     let mut gone_trough_unsafe_cell_raw_get = false;
 

tests/ui/cast/cast-rfc0401.rs

@@ -82,8 +82,8 @@ fn main()
 
     // ptr-ptr-cast (Length vtables)
     let mut l : [u8; 2] = [0,1];
-    let w: *mut [u16; 2] = &mut l as *mut [u8; 2] as *mut _;
-    let w: *mut [u16] = unsafe {&mut *w};
+    let w: *mut [i8; 2] = &mut l as *mut [u8; 2] as *mut _;
+    let w: *mut [i8] = unsafe {&mut *w};
     let w_u8 : *const [u8] = w as *const [u8];
     assert_eq!(unsafe{&*w_u8}, &l);
 

tests/ui/lint/reference_casting.rs

@@ -32,7 +32,7 @@ unsafe fn ref_to_mut() {
     //~^ ERROR casting `&T` to `&mut T` is undefined behavior
     let _num = &mut *(num as *const i32).cast::<i32>().cast_mut().cast_const().cast_mut();
     //~^ ERROR casting `&T` to `&mut T` is undefined behavior
-    let _num = &mut *(std::ptr::from_ref(static_u8()) as *mut i32);
+    let _num = &mut *(std::ptr::from_ref(static_u8()) as *mut i8);
     //~^ ERROR casting `&T` to `&mut T` is undefined behavior
     let _num = &mut *std::mem::transmute::<_, *mut i32>(num);
     //~^ ERROR casting `&T` to `&mut T` is undefined behavior
@@ -143,6 +143,79 @@ unsafe fn assign_to_ref() {
     }
 }
 
+#[repr(align(16))]
+struct I64(i64);
+
+#[repr(C)]
+struct Mat3<T> {
+    a: Vec3<T>,
+    b: Vec3<T>,
+    c: Vec3<T>,
+}
+
+#[repr(C)]
+struct Vec3<T>(T, T, T);
+
+unsafe fn bigger_layout() {
+    {
+        let num = &mut 3i32;
+
+        let _num = &*(num as *const i32 as *const i64);
+        //~^ ERROR casting references to a bigger memory layout is undefined behavior
+        let _num = &mut *(num as *mut i32 as *mut i64);
+        //~^ ERROR casting references to a bigger memory layout is undefined behavior
+        let _num = &mut *(num as *mut i32 as *mut I64);
+        //~^ ERROR casting references to a bigger memory layout is undefined behavior
+        std::ptr::write(num as *mut i32 as *mut i64, 2);
+        //~^ ERROR casting references to a bigger memory layout is undefined behavior
+
+        let _num = &mut *(num as *mut i32);
+    }
+
+    {
+        let num = &mut [0i32; 3];
+
+        let _num = &mut *(num as *mut _ as *mut [i64; 2]);
+        //~^ ERROR casting references to a bigger memory layout is undefined behavior
+        std::ptr::write_unaligned(num as *mut _ as *mut [i32; 4], [0, 0, 1, 1]);
+        //~^ ERROR casting references to a bigger memory layout is undefined behavior
+
+        let _num = &mut *(num as *mut _ as *mut [u32; 3]);
+        let _num = &mut *(num as *mut _ as *mut [u32; 2]);
+    }
+
+    {
+        let num = &mut [0i32; 3] as &mut [i32];
+
+        let _num = &mut *(num as *mut _ as *mut [i64]);
+        //~^ ERROR casting references to a bigger memory layout is undefined behavior
+        let _num = &mut *(num as *mut _ as *mut [i64; 4]);
+        //~^ ERROR casting references to a bigger memory layout is undefined behavior
+
+        let _num = &mut *(num as *mut _ as *mut [u32]);
+        let _num = &mut *(num as *mut _ as *mut [i16]);
+    }
+
+    {
+        let mat3 = Mat3 { a: Vec3(0i32, 0, 0), b: Vec3(0, 0, 0), c: Vec3(0, 0, 0) };
+
+        let _num = &mut *(&mat3 as *const _ as *mut [[i64; 3]; 3]);
+        //~^ ERROR casting `&T` to `&mut T` is undefined behavior
+        //~^^ ERROR casting references to a bigger memory layout is undefined behavior
+        let _num = &*(&mat3 as *const _ as *mut [[i64; 3]; 3]);
+        //~^ ERROR casting references to a bigger memory layout is undefined behavior
+
+        let _num = &*(&mat3 as *const _ as *mut [[i32; 3]; 3]);
+    }
+
+    {
+        let mut l : [u8; 2] = [0,1];
+        let w: *mut [u16; 2] = &mut l as *mut [u8; 2] as *mut _;
+        let w: *mut [u16] = unsafe {&mut *w};
+        //~^ ERROR casting references to a bigger memory layout is undefined behavior
+    }
+}
+
 const RAW_PTR: *mut u8 = 1 as *mut u8;
 unsafe fn no_warn() {
     let num = &3i32;

tests/ui/lint/reference_casting.stderr

@@ -66,8 +66,8 @@ LL |     let _num = &mut *(num as *const i32).cast::<i32>().cast_mut().cast_cons
 error: casting `&T` to `&mut T` is undefined behavior, even if the reference is unused, consider instead using an `UnsafeCell`
   --> $DIR/reference_casting.rs:35:16
    |
-LL |     let _num = &mut *(std::ptr::from_ref(static_u8()) as *mut i32);
-   |                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+LL |     let _num = &mut *(std::ptr::from_ref(static_u8()) as *mut i8);
+   |                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    |
    = note: for more information, visit <https://doc.rust-lang.org/book/ch15-05-interior-mutability.html>
 
@@ -373,5 +373,103 @@ LL |         *(this as *const _ as *mut _) = a;
    |
    = note: for more information, visit <https://doc.rust-lang.org/book/ch15-05-interior-mutability.html>
 
-error: aborting due to 42 previous errors
+error: casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+  --> $DIR/reference_casting.rs:163:20
+   |
+LL |         let _num = &*(num as *const i32 as *const i64);
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: casting from `i32` (size: 4 bytes, align: 4 bytes) to `i64` (size: 8 bytes, align: 8 bytes)
+
+error: casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+  --> $DIR/reference_casting.rs:165:20
+   |
+LL |         let _num = &mut *(num as *mut i32 as *mut i64);
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: casting from `i32` (size: 4 bytes, align: 4 bytes) to `i64` (size: 8 bytes, align: 8 bytes)
+
+error: casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+  --> $DIR/reference_casting.rs:167:20
+   |
+LL |         let _num = &mut *(num as *mut i32 as *mut I64);
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: casting from `i32` (size: 4 bytes, align: 4 bytes) to `I64` (size: 16 bytes, align: 16 bytes)
+
+error: casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+  --> $DIR/reference_casting.rs:169:9
+   |
+LL |         std::ptr::write(num as *mut i32 as *mut i64, 2);
+   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: casting from `i32` (size: 4 bytes, align: 4 bytes) to `i64` (size: 8 bytes, align: 8 bytes)
+
+error: casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+  --> $DIR/reference_casting.rs:178:20
+   |
+LL |         let _num = &mut *(num as *mut _ as *mut [i64; 2]);
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: casting from `[i32; 3]` (size: 12 bytes, align: 4 bytes) to `[i64; 2]` (size: 16 bytes, align: 8 bytes)
+
+error: casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+  --> $DIR/reference_casting.rs:180:9
+   |
+LL |         std::ptr::write_unaligned(num as *mut _ as *mut [i32; 4], [0, 0, 1, 1]);
+   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: casting from `[i32; 3]` (size: 12 bytes, align: 4 bytes) to `[i32; 4]` (size: 16 bytes, align: 4 bytes)
+
+error: casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+  --> $DIR/reference_casting.rs:190:20
+   |
+LL |         let _num = &mut *(num as *mut _ as *mut [i64]);
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: casting from `[i32; 3]` (size: 12 bytes, align: 4 bytes) to `[i64]` (size: 0 bytes, align: 8 bytes)
+
+error: casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+  --> $DIR/reference_casting.rs:192:20
+   |
+LL |         let _num = &mut *(num as *mut _ as *mut [i64; 4]);
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: casting from `[i32; 3]` (size: 12 bytes, align: 4 bytes) to `[i64; 4]` (size: 32 bytes, align: 8 bytes)
+
+error: casting `&T` to `&mut T` is undefined behavior, even if the reference is unused, consider instead using an `UnsafeCell`
+  --> $DIR/reference_casting.rs:202:20
+   |
+LL |         let _num = &mut *(&mat3 as *const _ as *mut [[i64; 3]; 3]);
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: for more information, visit <https://doc.rust-lang.org/book/ch15-05-interior-mutability.html>
+
+error: casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+  --> $DIR/reference_casting.rs:202:20
+   |
+LL |         let _num = &mut *(&mat3 as *const _ as *mut [[i64; 3]; 3]);
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: casting from `Mat3<i32>` (size: 36 bytes, align: 4 bytes) to `[[i64; 3]; 3]` (size: 72 bytes, align: 8 bytes)
+
+error: casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+  --> $DIR/reference_casting.rs:205:20
+   |
+LL |         let _num = &*(&mat3 as *const _ as *mut [[i64; 3]; 3]);
+   |                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+   |
+   = note: casting from `Mat3<i32>` (size: 36 bytes, align: 4 bytes) to `[[i64; 3]; 3]` (size: 72 bytes, align: 8 bytes)
+
+error: casting references to a bigger memory layout is undefined behavior, even if the reference is unused
+  --> $DIR/reference_casting.rs:214:37
+   |
+LL |         let w: *mut [u16; 2] = &mut l as *mut [u8; 2] as *mut _;
+   |                                -------------------------------- casting happend here
+LL |         let w: *mut [u16] = unsafe {&mut *w};
+   |                                     ^^^^^^^
+   |
+   = note: casting from `[u8; 2]` (size: 2 bytes, align: 1 bytes) to `[u16; 2]` (size: 4 bytes, align: 2 bytes)
+
+error: aborting due to 54 previous errors