disallow `from_exposed_addr(ptr.addr())`

[KisaragiEffective]

What it does

disallows from_exposed_addr(ptr.addr()) if the code is under #![feature(strict_provenance)]. The argument of from_exposed_addr can be value of expose_addr while addr cannot.

Lint Name

create_ptr_from_unexposed_addr

Category

correctness

Advantage

• Prevents UB.

Drawbacks

None

Example

#![feature(strict_provenance)]
fn main() {
    let elem = 0u64;
    let x: *const u8 = std::ptr::from_exposed_addr((&elem as *const u64).addr())
}

Could be written as:

    let elem = 0u64;
    let x: *const u8 = std::ptr::from_exposed_addr((&elem as *const u64).exposed_addr())

[Alexendoo]

I've read a bit about provenance but not super in depth on the proposed rust API, would this sort of thing come up? I can't see the reason why you would want to call from_exposed_addr when you already have the pointer in the first place

[briansmith]

rust-lang/rust#122964 renamed exposed_addr to exposed_provenance(), https://doc.rust-lang.org/std/primitive.pointer.html#method.expose_provenance.
rust-lang/rust#122935 renamed from_exposed_addr to with_exposed_provenance,, https://doc.rust-lang.org/std/ptr/fn.with_exposed_provenance.html. Both were stabilized in 1.84.

I guess such a lint should also warn against x.addr() as usize if x is not a temporary (if x is a temporary, then as usize causes temporary lifetime extension.