Prevent downstream `impl DerefMut for Pin<LocalType>` by Darksonn · Pull Request #145608 · rust-lang/rust

Darksonn · 2025-08-19T14:51:03Z

The safety requirements for PinCoerceUnsized are essentially that the type does not have a malicious Deref or DerefMut impl. However, the Pin type is fundamental, so the end-user can provide their own implementation of DerefMut for Pin<&SomeLocalType>, so it's possible for Pin to have a malicious DerefMut impl. This unsoundness is known as #85099.

Unfortunately, this means that the implementation of PinCoerceUnsized for Pin is currently unsound. To fix that, modify the impl so that it becomes impossible for downstream crates to provide their own implementation of DerefMut for Pin by abusing a hidden struct that is not fundamental.

This PR is a breaking change, but it fixes#85099. The PR supersedes #144896.

r? lcnr

Darksonn · 2025-08-19T15:11:52Z

It doesn't immediately look like error messages have regressed, but the docs have:

I'm going to push another commit to improve the docs to this:

I think it's reasonable in this case since the impls really are equivalent except for the orphan rules treatment.

lcnr · 2025-08-19T15:17:00Z

I want to make sure I properly understand #85099 before merging this. I do think it's a very nice solution and gj for coming up with it!

I personally dislike "lying in the impl", even if it doesn't matter in practice. Gonna throw that question to @rust-lang/libs-api.

Let's crater

@bors try

Prevent downstream impl DerefMut for Pin

dtolnay · 2025-08-19T16:06:43Z

We discussed this PR in today's standard library API meeting. Those present were on board with the approach, but it will be important to see a reasonably clean crater result and send PRs for any breakage, because not all downstream impls of DerefMut for Pin are necessarily unsound. The new implementation rules out correct as well as incorrect impls.

Once crater is finished, we would like to do a libs-api FCP to surface this to the rest of the team.

We noticed that the new pin::hidden::PinHelper type is now going to appear in diagnostics such as the pin-unsound-issue-85099-derefmut.stderr in this PR, but hopefully this mostly only happens when someone is doing funny business like writing their own DerefMut impl, and not for more typical use of Pin's methods and impls.

Darksonn · 2025-08-19T16:10:16Z

Ok, let's see what crater says. But I don't think there are any valid use-cases for impl DerefMut for Pin<P> for pointer types that aren't DerefMut.

rust-bors · 2025-08-19T17:31:25Z

☀️ Try build successful (CI)
Build commit: c659ee1 (c659ee110de67e82444e4b6c8407c1a9af9c2cf6, parent: 8c32e313cccf7df531e2d49ffb8227bb92304aee)

lcnr · 2025-08-19T17:38:57Z

@craterbot check

craterbot · 2025-08-19T17:39:15Z

👌 Experiment pr-145608 created and queued.
🤖 Automatically detected try build c659ee1
🔍 You can check out the queue and this experiment's details.

ℹ️ Crater is a tool to run experiments across parts of the Rust ecosystem. Learn more

Darksonn · 2025-08-19T17:45:40Z

Updating this with some additional tests for error messages. I'm not worried about PinHelper showing up in pin-unsound-issue-85099-derefmut.stderr, but that it also shows up in tests/ui/deref/pin-impl-deref.stderr is unfortunate.

(See individual commits for how the error messages change.)

Darksonn · 2025-08-19T18:03:47Z

A slightly different implementation seems to give somewhat better errors:

Darksonn@5e4d49a

But let's wait for crater before we think about that further.

craterbot · 2025-08-21T16:02:58Z

🚧 Experiment pr-145608 is now running

ℹ️ Crater is a tool to run experiments across parts of the Rust ecosystem. Learn more

craterbot · 2025-08-22T22:48:37Z

🎉 Experiment pr-145608 is completed!
📊 6 regressed and 8 fixed (685389 total)
📰 Open the summary report.

⚠️ If you notice any spurious failure please add them to the denylist!
ℹ️ Crater is a tool to run experiments across parts of the Rust ecosystem. Learn more

Rollup of 7 pull requests Successful merges: - #143900 ([rustdoc] Correctly handle `should_panic` doctest attribute and fix `--no-run` test flag on the 2024 edition) - #145608 (Prevent downstream `impl DerefMut for Pin<LocalType>`) - #146865 (kcfi: only reify trait methods when dyn-compatible) - #147390 (Use globals instead of metadata for std::autodiff) - #147398 (Fix; correct placement of type inference error for method calls) - #147431 (compiletest: Read the whole test file before parsing directives) - #147433 (Fix doc comment) r? `@ghost` `@rustbot` modify labels: rollup

Prevent downstream `impl DerefMut for Pin<LocalType>` The safety requirements for [`PinCoerceUnsized`](https://doc.rust-lang.org/stable/std/pin/trait.PinCoerceUnsized.html) are essentially that the type does not have a malicious `Deref` or `DerefMut` impl. However, the `Pin` type is fundamental, so the end-user can provide their own implementation of `DerefMut` for `Pin<&SomeLocalType>`, so it's possible for `Pin` to have a malicious `DerefMut` impl. This unsoundness is known as #85099. Unfortunately, this means that the implementation of `PinCoerceUnsized` for `Pin` is currently unsound. To fix that, modify the impl so that it becomes impossible for downstream crates to provide their own implementation of `DerefMut` for `Pin` by abusing a hidden struct that is not fundamental. This PR is a breaking change, but it fixes#85099. The PR supersedes #144896. r? lcnr

bors · 2025-10-07T11:41:10Z

⌛ Testing commit 76dcb39 with merge 052a6fe...

Prevent downstream `impl DerefMut for Pin<LocalType>` The safety requirements for [`PinCoerceUnsized`](https://doc.rust-lang.org/stable/std/pin/trait.PinCoerceUnsized.html) are essentially that the type does not have a malicious `Deref` or `DerefMut` impl. However, the `Pin` type is fundamental, so the end-user can provide their own implementation of `DerefMut` for `Pin<&SomeLocalType>`, so it's possible for `Pin` to have a malicious `DerefMut` impl. This unsoundness is known as rust-lang#85099. Unfortunately, this means that the implementation of `PinCoerceUnsized` for `Pin` is currently unsound. To fix that, modify the impl so that it becomes impossible for downstream crates to provide their own implementation of `DerefMut` for `Pin` by abusing a hidden struct that is not fundamental. This PR is a breaking change, but it fixesrust-lang#85099. The PR supersedes rust-lang#144896. r? lcnr

Zalathar · 2025-10-07T11:44:48Z

Yielding to enclosing rollup.

@bors retry

Rollup of 8 pull requests Successful merges: - #145608 (Prevent downstream `impl DerefMut for Pin<LocalType>`) - #146865 (kcfi: only reify trait methods when dyn-compatible) - #147205 (Add a new `wasm32-wasip3` target to Rust) - #147390 (Use globals instead of metadata for std::autodiff) - #147398 (Fix; correct placement of type inference error for method calls) - #147422 (collect-license-metadata: Print a diff of the expected output) - #147431 (compiletest: Read the whole test file before parsing directives) - #147433 (Fix doc comment) r? `@ghost` `@rustbot` modify labels: rollup

Prevent downstream `impl DerefMut for Pin<LocalType>` The safety requirements for [`PinCoerceUnsized`](https://doc.rust-lang.org/stable/std/pin/trait.PinCoerceUnsized.html) are essentially that the type does not have a malicious `Deref` or `DerefMut` impl. However, the `Pin` type is fundamental, so the end-user can provide their own implementation of `DerefMut` for `Pin<&SomeLocalType>`, so it's possible for `Pin` to have a malicious `DerefMut` impl. This unsoundness is known as #85099. Unfortunately, this means that the implementation of `PinCoerceUnsized` for `Pin` is currently unsound. To fix that, modify the impl so that it becomes impossible for downstream crates to provide their own implementation of `DerefMut` for `Pin` by abusing a hidden struct that is not fundamental. This PR is a breaking change, but it fixes#85099. The PR supersedes #144896. r? lcnr

bors · 2025-10-07T12:44:32Z

⌛ Testing commit 76dcb39 with merge dfeac91...

fmease · 2025-10-07T12:47:42Z

Yielding to overarching rollup @bors retry

Rollup of 8 pull requests Successful merges: - #145608 (Prevent downstream `impl DerefMut for Pin<LocalType>`) - #146865 (kcfi: only reify trait methods when dyn-compatible) - #147205 (Add a new `wasm32-wasip3` target to Rust) - #147390 (Use globals instead of metadata for std::autodiff) - #147398 (Fix; correct placement of type inference error for method calls) - #147422 (collect-license-metadata: Print a diff of the expected output) - #147431 (compiletest: Read the whole test file before parsing directives) - #147433 (Fix doc comment) r? `@ghost` `@rustbot` modify labels: rollup

bors · 2025-10-07T14:26:51Z

⌛ Testing commit 76dcb39 with merge fed46ff...

bors · 2025-10-07T17:36:49Z

☀️ Test successful - checks-actions
Approved by: lcnr
Pushing fed46ff to master...

github-actions · 2025-10-07T17:39:42Z

What is this?

This is an experimental post-merge analysis report that shows differences in test outcomes between the merged PR and its parent PR.

Comparing 4a54b26 (parent) -> fed46ff (this PR)

Test differences

Show 20 test diffs

20 doctest diffs were found. These are ignored, as they are noisy.

Test dashboard

Run

cargo run --manifest-path src/ci/citool/Cargo.toml -- \
test-dashboard fed46ffd5059e11669df1bd9406b02914c3fb73f --output-dir test-dashboard

And then open test-dashboard/index.html in your browser to see an overview of all executed tests.

Job duration changes

dist-aarch64-linux: 8607.1s -> 6204.2s (-27.9%)
x86_64-gnu-llvm-20-1: 3216.0s -> 3666.2s (14.0%)
pr-check-1: 1598.6s -> 1375.2s (-14.0%)
x86_64-gnu-llvm-20: 2752.6s -> 2466.6s (-10.4%)
dist-x86_64-apple: 7843.4s -> 7078.3s (-9.8%)
x86_64-mingw-2: 7563.8s -> 8203.4s (8.5%)
test-various: 4460.8s -> 4822.2s (8.1%)
dist-x86_64-musl: 8524.6s -> 7836.7s (-8.1%)
i686-msvc-2: 7783.4s -> 8387.2s (7.8%)
i686-gnu-1: 7945.8s -> 7333.4s (-7.7%)

How to interpret the job duration changes?

Job durations can vary a lot, based on the actual runner instance
that executed the job, system noise, invalidated caches, etc. The table above is provided
mostly for t-infra members, for simpler debugging of potential CI slow-downs.

rust-timer · 2025-10-07T19:26:07Z

Finished benchmarking commit (fed46ff): comparison URL.

Overall result: ❌✅ regressions and improvements - please read the text below

Our benchmarks found a performance regression caused by this PR.
This might be an actual regression, but it can also be just noise.

Next Steps:

If the regression was expected or you think it can be justified,
please write a comment with sufficient written justification, and add
@rustbot label: +perf-regression-triaged to it, to mark the regression as triaged.
If you think that you know of a way to resolve the regression, try to create
a new PR with a fix for the regression.
If you do not understand the regression or you think that it is just noise,
you can ask the @rust-lang/wg-compiler-performance working group for help (members of this group
were already notified of this PR).

@rustbot label: +perf-regression
cc @rust-lang/wg-compiler-performance

Instruction count

Our most reliable metric. Used to determine the overall result above. However, even this metric can be noisy.

	mean	range	count
Regressions ❌ (primary)	0.3%	[0.3%, 0.3%]	2
Regressions ❌ (secondary)	-	-	0
Improvements ✅ (primary)	-	-	0
Improvements ✅ (secondary)	-0.0%	[-0.0%, -0.0%]	1
All ❌✅ (primary)	0.3%	[0.3%, 0.3%]	2

Max RSS (memory usage)

Results (primary 1.8%, secondary 1.6%)

A less reliable metric. May be of interest, but not used to determine the overall result above.

	mean	range	count
Regressions ❌ (primary)	1.8%	[1.8%, 1.8%]	1
Regressions ❌ (secondary)	3.6%	[2.1%, 5.1%]	2
Improvements ✅ (primary)	-	-	0
Improvements ✅ (secondary)	-2.2%	[-2.2%, -2.2%]	1
All ❌✅ (primary)	1.8%	[1.8%, 1.8%]	1

Cycles

This benchmark run did not return any relevant results for this metric.

Binary size

Results (primary 0.1%)

A less reliable metric. May be of interest, but not used to determine the overall result above.

	mean	range	count
Regressions ❌ (primary)	0.1%	[0.0%, 0.4%]	5
Regressions ❌ (secondary)	-	-	0
Improvements ✅ (primary)	-	-	0
Improvements ✅ (secondary)	-	-	0
All ❌✅ (primary)	0.1%	[0.0%, 0.4%]	5

Bootstrap: 473.216s -> 474.165s (0.20%)
Artifact size: 388.39 MiB -> 388.38 MiB (-0.00%)

Kobzol · 2025-10-13T19:39:01Z

Tiny regression on hyper, otherwise netural. And since this is a soundness fix:

@rustbot label: +perf-regression-triaged

Darksonn added T-lang Relevant to the language team A-pin Area: Pin T-types Relevant to the types team, which will review and decide on the PR/issue. labels Aug 19, 2025

Darksonn requested a review from lcnr August 19, 2025 14:53

rustbot assigned lcnr Aug 19, 2025

rustbot added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Aug 19, 2025

rust-borsBot added a commit that referenced this pull request Aug 19, 2025
Auto merge of#145608- Darksonn:derefmut-pin-fix, r=<try>
c659ee1
Prevent downstream impl DerefMut for Pin

This comment has been minimized.
Sign in to view

dtolnay added the I-libs-api-nominated [DEPRECATED; DO NOT USE] label Aug 19, 2025

dtolnay removed the I-libs-api-nominated [DEPRECATED; DO NOT USE] label Aug 19, 2025

craterbot added S-waiting-on-crater Status: Waiting on a crater run to be completed. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Aug 19, 2025

Darksonn force-pushed the derefmut-pin-fix branch from 017ed97 to 9bb2a3aCompare August 19, 2025 17:44

Darksonn changed the title ~~Prevent downstream impl DerefMut for Pin~~Prevent downstream impl DerefMut for Pin<LocalType>Aug 19, 2025

traviscross added P-lang-drag-2 Lang team prioritization drag level 2.https://rust-lang.zulipchat.com/#narrow/channel/410516-t-lang. and removed P-lang-drag-1 Lang team prioritization drag level 1. https://rust-lang.zulipchat.com/#narrow/channel/410516-t-lang labels Aug 20, 2025

Zalathar mentioned this pull request Oct 7, 2025
Rollup of 8 pull requests #147440
Closed

bors added the merged-by-bors This PR was explicitly merged by bors. label Oct 7, 2025

bors merged commit fed46ff into rust-lang:masterOct 7, 2025
11 checks passed

rustbot added this to the 1.92.0 milestone Oct 7, 2025

bors mentioned this pull request Oct 7, 2025
[TOY] Run MIR opts before coroutine state transform #145330
Draft

Darksonn mentioned this pull request Oct 22, 2025
PinDerefMutHelper should not show up in impl DerefMut for Pin #147998
Open

Darksonn mentioned this pull request Nov 13, 2025
derive(CoercePointee) is unsound with user-defined attribute macros. #148899
Open

tmandry mentioned this pull request Nov 18, 2025
Add Alice Ryhl to lang-advisors rust-lang/team#2089
Merged

cuviper mentioned this pull request Nov 20, 2025
Draft release notes for 1.92 #149161
Closed

This was referenced Dec 11, 2025
DispatchFromDyn: require additional checks #149068
Closed
Unsoundness and ICE due to DispatchFromDyn allowing bogus impls on references. #148727
Open

This was referenced May 26, 2026
dyn Allocator together with Allocator + Clone requirements is unsound, leading to UB with Arc#156920
Closed
Introduce a PinSafePointer trait that generalizes PinCoerceUnsized#156935
Merged

nia-e mentioned this pull request Aug 16, 2026
Add section on impl existence reasoning google/rust-skills#2
Merged

ShaddyDC mentioned this pull request Aug 25, 2026
Add anti-fundamental attribute #160391
Draft

Uh oh!

Uh oh!

Conversation

Darksonn commented Aug 19, 2025• edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Darksonn commented Aug 19, 2025

Uh oh!

lcnr commented Aug 19, 2025

Uh oh!

This comment has been minimized.

dtolnay commented Aug 19, 2025

Uh oh!

Darksonn commented Aug 19, 2025

Uh oh!

rust-borsBot commented Aug 19, 2025

Uh oh!

lcnr commented Aug 19, 2025

Uh oh!

craterbot commented Aug 19, 2025

Uh oh!

Darksonn commented Aug 19, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Darksonn commented Aug 19, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

craterbot commented Aug 21, 2025

Uh oh!

craterbot commented Aug 22, 2025

Uh oh!

bors commented Oct 7, 2025

Uh oh!

Zalathar commented Oct 7, 2025

Uh oh!

bors commented Oct 7, 2025

Uh oh!

fmease commented Oct 7, 2025

Uh oh!

bors commented Oct 7, 2025

Uh oh!

bors commented Oct 7, 2025

Uh oh!

Uh oh!

github-actionsBot commented Oct 7, 2025

Test differences

Job duration changes

Uh oh!

rust-timer commented Oct 7, 2025

Overall result: ❌✅ regressions and improvements - please read the text below

Instruction count

Max RSS (memory usage)

Cycles

Binary size

Uh oh!

Kobzol commented Oct 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Darksonn commented Aug 19, 2025•
edited by rustbot
Loading

Darksonn commented Aug 19, 2025•
edited
Loading

Darksonn commented Aug 19, 2025•
edited
Loading