Null reference as insta-UB [LWN.net]

Null reference as insta-UB

Posted Aug 21, 2024 20:38 UTC (Wed) by riking (subscriber, #95706)
In reply to: Null reference as insta-UB by farnz
Parent article: Standards for use of unsafe Rust in the kernel

Note: "references must point to a valid instance of the object" is actually the safety invariant. The validity invariant is "initialized, non-null, aligned to the alignment of the object".

(What does that mean? It means that unsafe code can temporarily hold references that don't point to valid objects as long as it's careful what it does with them (doesn't try to read) and doesn't let the reference escape into safe code not controlled by the author of the unsafe code.)

to post comments

Null reference as insta-UB

Posted Aug 21, 2024 21:14 UTC (Wed) by mb (subscriber, #50428) [Link] (2 responses)

But this is only true for "initialized". Even unsafe is not allowed to construct null-references.

Null reference as insta-UB

Posted Aug 21, 2024 22:07 UTC (Wed) by riking (subscriber, #95706) [Link] (1 responses)

The validity invariant is the things that unsafe code can't ever do. The safety invariant is the things it can be careful about and can't let escape to uncontrolled safe code.

Null reference as insta-UB

Posted Aug 21, 2024 22:22 UTC (Wed) by mb (subscriber, #50428) [Link]

Ok, I guess I don't understand your original posting then.

Null reference as insta-UB

Posted Aug 22, 2024 8:11 UTC (Thu) by farnz (subscriber, #17727) [Link]

That's why I said references must point to a valid place, not a valid instance. It's entirely permissible for the place that's pointed at to not be a valid instance, as long as it's a valid place for the referent type to live in.