Implement a lint for implicit autoref of raw pointer dereference

Author: WaffleLapkin

compiler/rustc_lint/src/implicit_unsafe_autorefs.rs

@@ -0,0 +1,83 @@
+use crate::{LateContext, LateLintPass, LintContext};
+
+use rustc_errors::Applicability;
+use rustc_hir::{self as hir, Expr, ExprKind, UnOp};
+use rustc_middle::ty::adjustment::{Adjust, AutoBorrow};
+
+declare_lint! {
+    /// The `implicit_unsafe_autorefs` lint checks for implicitly taken references to dereferences of raw pointers.
+    ///
+    /// ### Example
+    ///
+    /// ```rust
+    /// unsafe fn fun(ptr: *mut [u8]) -> *mut [u8] {
+    ///     addr_of_mut!((*ptr)[..16])
+    ///     //                 ^^^^^^ this calls `IndexMut::index_mut(&mut ..., ..16)`,
+    ///     //                        implicitly creating a reference
+    /// }
+    /// ```
+    ///
+    /// {{produces}}
+    ///
+    /// ### Explanation
+    ///
+    /// When working with raw pointers it's usually undesirable to create references,
+    /// since they inflict a lot of safety requirement. Unfortunately, it's possible
+    /// to take a reference to a dereferece of a raw pointer implitly, which inflicts
+    /// the usual reference requirements without you even knowing that.
+    /// 
+    /// If you are sure, you can soundly take a reference, then you can take it explicitly:
+    /// ```rust
+    /// unsafe fn fun(ptr: *mut [u8]) -> *mut [u8] {
+    ///     addr_of_mut!((&mut *ptr)[..16])
+    /// }
+    /// ```
+    /// 
+    /// Otherwise try to find an alternative way to achive your goals that work only with
+    /// raw pointers:
+    /// ```rust
+    /// #![feature(slice_ptr_get)]
+    /// 
+    /// unsafe fn fun(ptr: *mut [u8]) -> *mut [u8] {
+    ///     ptr.get_unchecked_mut(..16)
+    /// }
+    /// ```
+    pub IMPLICIT_UNSAFE_AUTOREFS,
+    Deny,
+    "implicit reference to a dereference of a raw pointer"
+}
+
+declare_lint_pass!(ImplicitUnsafeAutorefs => [IMPLICIT_UNSAFE_AUTOREFS]);
+
+impl<'tcx> LateLintPass<'tcx> for ImplicitUnsafeAutorefs {
+    fn check_expr(&mut self, cx: &LateContext<'tcx>, expr: &'tcx Expr<'_>) {
+        let typeck = cx.typeck_results();
+        let adjustments_table = typeck.adjustments();
+
+        if let Some(adjustments) = adjustments_table.get(expr.hir_id) 
+        && let [adjustment] = &**adjustments
+        // An auto-borrow
+        && let Adjust::Borrow(AutoBorrow::Ref(_, mutbl)) = adjustment.kind
+        // ... of a deref
+        && let ExprKind::Unary(UnOp::Deref, dereferenced) = expr.kind
+        // ... of a raw pointer
+        && typeck.expr_ty(dereferenced).is_unsafe_ptr()
+        {
+            let mutbl = hir::Mutability::prefix_str(&mutbl.into());
+            
+            let msg = "implicit auto-ref creates a reference to a dereference of a raw pointer";
+            cx.struct_span_lint(IMPLICIT_UNSAFE_AUTOREFS, expr.span, msg, |lint| {
+                lint
+                    .note("creating a reference inflicts a lot of safety requirements")
+                    .multipart_suggestion(
+                        "if this reference is intentional, make it explicit", 
+                        vec![
+                            (expr.span.shrink_to_lo(), format!("(&{mutbl}")),
+                            (expr.span.shrink_to_hi(), ")".to_owned())
+                        ], 
+                        Applicability::MaybeIncorrect
+                    )
+            })
+        }
+    }
+}

compiler/rustc_lint/src/lib.rs

@@ -54,6 +54,7 @@ mod errors;
 mod expect;
 mod for_loops_over_fallibles;
 pub mod hidden_unicode_codepoints;
+mod implicit_unsafe_autorefs;
 mod internal;
 mod late;
 mod let_underscore;
@@ -89,6 +90,7 @@ use builtin::*;
 use enum_intrinsics_non_enums::EnumIntrinsicsNonEnums;
 use for_loops_over_fallibles::*;
 use hidden_unicode_codepoints::*;
+use implicit_unsafe_autorefs::*;
 use internal::*;
 use let_underscore::*;
 use methods::*;
@@ -191,6 +193,7 @@ macro_rules! late_lint_mod_passes {
             $args,
             [
                 ForLoopsOverFallibles: ForLoopsOverFallibles,
+                ImplicitUnsafeAutorefs: ImplicitUnsafeAutorefs,
                 HardwiredLints: HardwiredLints,
                 ImproperCTypesDeclarations: ImproperCTypesDeclarations,
                 ImproperCTypesDefinitions: ImproperCTypesDefinitions,

src/test/ui/lint/implicit_unsafe_autorefs.fixed

@@ -0,0 +1,14 @@
+// run-rustfix
+use std::ptr::{addr_of, addr_of_mut};
+
+unsafe fn _test_mut(ptr: *mut [u8]) -> *mut [u8] {
+    addr_of_mut!((&mut (*ptr))[..16])
+    //~^ error: implicit auto-ref creates a reference to a dereference of a raw pointer
+}
+
+unsafe fn _test_const(ptr: *const [u8]) -> *const [u8] {
+    addr_of!((&(*ptr))[..16])
+    //~^ error: implicit auto-ref creates a reference to a dereference of a raw pointer
+}
+
+fn main() {}

src/test/ui/lint/implicit_unsafe_autorefs.rs

@@ -0,0 +1,14 @@
+// run-rustfix
+use std::ptr::{addr_of, addr_of_mut};
+
+unsafe fn _test_mut(ptr: *mut [u8]) -> *mut [u8] {
+    addr_of_mut!((*ptr)[..16])
+    //~^ error: implicit auto-ref creates a reference to a dereference of a raw pointer
+}
+
+unsafe fn _test_const(ptr: *const [u8]) -> *const [u8] {
+    addr_of!((*ptr)[..16])
+    //~^ error: implicit auto-ref creates a reference to a dereference of a raw pointer
+}
+
+fn main() {}

src/test/ui/lint/implicit_unsafe_autorefs.stderr

@@ -0,0 +1,27 @@
+error: implicit auto-ref creates a reference to a dereference of a raw pointer
+  --> $DIR/implicit_unsafe_autoref.rs:5:18
+   |
+LL |     addr_of_mut!((*ptr)[..16])
+   |                  ^^^^^^
+   |
+   = note: creating a reference inflicts a lot of safety requirements
+   = note: `#[deny(implicit_unsafe_autorefs)]` on by default
+help: if this reference is intentional, make it explicit
+   |
+LL |     addr_of_mut!((&mut (*ptr))[..16])
+   |                  +++++       +
+
+error: implicit auto-ref creates a reference to a dereference of a raw pointer
+  --> $DIR/implicit_unsafe_autoref.rs:10:14
+   |
+LL |     addr_of!((*ptr)[..16])
+   |              ^^^^^^
+   |
+   = note: creating a reference inflicts a lot of safety requirements
+help: if this reference is intentional, make it explicit
+   |
+LL |     addr_of!((&(*ptr))[..16])
+   |              ++      +
+
+error: aborting due to 2 previous errors
+