Use deref target in Pin trait implementations #67039
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
(rust_highfive has picked a reviewer for you, use r? to override) |
rust-highfive
added
the
S-waiting-on-review
jonas-schievink
added
I-unsound
|
Should we crater this? @bors try |
bors
added a commit
that referenced
this pull request
Dec 4, 2019
Use deref target in Pin trait implementations Using deref target instead of pointer itself avoids providing access to `&Rc<T>` for malicious implementations, which would allow calling `Rc::get_mut`. This is a breaking change necessary due to unsoundness, however the impact of it should be minimal. This only fixes the issue with malicious `PartialEq` implementations, other `Pin` soundness issues are still here. See <https://internals.rust-lang.org/t/unsoundness-in-pin/11311/73> for more details.
|
☀️ Try build successful - checks-azure |
|
Seems good to me. I’d be interested to see crater results. |
RalfJung
reviewed
Dec 5, 2019
RalfJung
reviewed
Dec 5, 2019
RalfJung
reviewed
Dec 5, 2019
Centril
reviewed
Dec 5, 2019
RalfJung
reviewed
Dec 5, 2019
RalfJung
reviewed
Dec 5, 2019
This comment has been minimized.
This comment has been minimized.
|
It would be good to add UI tests to this PR so that we have checks ensuring that the problematic pattern this is meant to catch cannot happen in the future. |
KamilaBorowska
force-pushed
the
manually-implement-pin-traits
branch
2 times, most recently
from
8bee4ff
to
efaba2d
Compare
|
@Centril Added UI test. |
Using deref target instead of pointer itself avoids providing access to `&Rc<T>` for malicious implementations, which would allow calling `Rc::get_mut`. This is a breaking change necessary due to unsoundness, however the impact of it should be minimal. This only fixes the issue with malicious `PartialEq` implementations, other `Pin` soundness issues are still here. See <https://internals.rust-lang.org/t/unsoundness-in-pin/11311/73> for more details.
KamilaBorowska
force-pushed
the
manually-implement-pin-traits
branch
from
efaba2d
to
6996ae1
Compare
|
Also, made amount of commits a bit smaller by merging some commits together. |
withoutboats
reviewed
Dec 6, 2019
|
big +1. these implementations were just unsound and this is the correct way to implement these traits for these types. |
nikomatsakis
approved these changes
Dec 9, 2019
|
@bors r+ I'm going to go ahead and r+ this without a crater run. It seems quite unlikely that we'll see any regressions here, and this is a soundness fix. |
|
📌 Commit 61d9c00 has been approved by |
bors
added
S-waiting-on-bors
bors
added a commit
that referenced
this pull request
Dec 10, 2019
…akis Use deref target in Pin trait implementations Using deref target instead of pointer itself avoids providing access to `&Rc<T>` for malicious implementations, which would allow calling `Rc::get_mut`. This is a breaking change necessary due to unsoundness, however the impact of it should be minimal. This only fixes the issue with malicious `PartialEq` implementations, other `Pin` soundness issues are still here. See <https://internals.rust-lang.org/t/unsoundness-in-pin/11311/73> for more details.
|
☀️ Test successful - checks-azure |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Using deref target instead of pointer itself avoids providing access to
&Rc<T>for malicious implementations, which would allow callingRc::get_mut.This is a breaking change necessary due to unsoundness, however the impact of it should be minimal.
This only fixes the issue with malicious
PartialEqimplementations, otherPinsoundness issues are still here.See https://internals.rust-lang.org/t/unsoundness-in-pin/11311/73 for more details.