Add lint against dangling pointers from local variables #144322

Urgau · 2025-07-22T19:43:40Z

`dangling_pointers_from_locals`

warn-by-default

The dangling_pointers_from_locals lint detects getting a pointer to data of a local that will be dropped at the end of the function.

Example

fn f() -> *const u8 {
    let x = 0;
    &x // returns a dangling ptr to `x`
}

warning: a dangling pointer will be produced because the local variable `x` will be dropped
  --> $DIR/dangling-pointers-from-locals.rs:10:5
   |
LL | fn simple() -> *const u8 {
   |                --------- return type of the function is `*const u8`
LL |     let x = 0;
   |         - `x` is defined inside the function and will be drop at the end of the function
LL |     &x
   |     ^^
   |
   = note: pointers do not have a lifetime; after returning, the `u8` will be deallocated at the end of the function because nothing is referencing it as far as the type system is concerned
   = note: `#[warn(dangling_pointers_from_locals)]` on by default

Explanation

Returning a pointer from a local value will not prolong its lifetime, which means that the value can be dropped and the allocation freed while the pointer still exists, making the pointer dangling.

If you need stronger guarantees, consider using references instead, as they are statically verified by the borrow-checker to never dangle.

This is related to GitHub codeql CWE-825 which shows examples of such simple miss-use.

It should be noted that C compilers warns against such patterns even without -Wall, https://godbolt.org/z/P7z98arrc.

@rustbot labels +I-lang-nominated +T-lang
cc @traviscross
r? compiler

rustbot · 2025-07-22T21:11:58Z

The Miri subtree was changed

cc @rust-lang/miri

traviscross · 2025-07-23T00:32:42Z

Thank to @Urgau for putting this together after he and I had talked about it. Let's do it.

@rfcbot fcp merge

rfcbot · 2025-07-23T00:32:45Z

Team member @traviscross has proposed to merge this. The next step is review by the rest of the tagged team members:

No concerns currently listed.

Once a majority of reviewers approve (and at most 2 approvals are outstanding), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

cc @rust-lang/lang-advisors: FCP proposed for lang, please feel free to register concerns.
See this document for info about what commands tagged team members can give me.

tmandry · 2025-07-23T15:53:13Z

@rfcbot reviewed

rfcbot · 2025-07-23T15:54:55Z

🔔 This is now entering its final comment period, as per the review above. 🔔

scottmcm · 2025-07-23T15:56:40Z

I would like us as lang to get a a world where we approve intent of lints, then the details are up to the diagnostics team, and under that framework I think the indent of "catch when people return pointers that are fundamentally useless to the caller" is clearly a good one.
@rfcbot reviewed

oli-obk

I'm not sure this is useful/general enough as it is, but I have nothing against it and the diagnostics look fine.

I think to generalize it we would have to write it as a lint that runs dataflow on MIR

compiler/rustc_lint/messages.ftl

oli-obk · 2025-07-28T16:06:23Z

compiler/rustc_lint/src/dangling.rs

+            // verify that we have a pointer type
+            let inner_ty = match ty.kind() {
+                ty::RawPtr(inner_ty, _) => *inner_ty,
+                _ => return,
+            };


this is a bit overprecise on just pointer return types and will not catch even tuples that contain raw pointers or generic Adts like Option. Ok as a first version, but I feel like it should be more general to be really useful.

compiler/rustc_lint/src/dangling.rs

saethlin · 2025-07-28T17:37:41Z

I'm not sure this is useful/general enough as it is

I think this is an empirical question that could be answered with crater. We can always just search crater for the warning when this lands in beta.

Urgau · 2025-07-28T17:37:51Z

I think to generalize it we would have to write it as a lint that runs dataflow on MIR

Agree. I wanted to have a first simple version, happy to try to switch the lint to run on the MIR dataflow framework after this one is merged.

@rustbot ready

oli-obk

Yea, I think merging as is is fine, and it obviously never has to be perfect, but I'm curious how far we can take it.

r=me with FCP finished

rfcbot · 2025-08-02T15:55:34Z

The final comment period, with a disposition to merge, as per the review above, is now complete.

As the automated representative of the governance process, I would like to thank the author for their work and everyone else who contributed.

This will be merged soon.

Urgau · 2025-08-02T17:48:17Z

@bors r=oli-obk

bors · 2025-08-02T17:48:19Z

📌 Commit 21ec0d5 has been approved by oli-obk

It is now in the queue for this repository.

…oli-obk Add lint against dangling pointers from local variables ## `dangling_pointers_from_locals` *warn-by-default* The `dangling_pointers_from_locals` lint detects getting a pointer to data of a local that will be dropped at the end of the function. ### Example ```rust fn f() -> *const u8 { let x = 0; &x // returns a dangling ptr to `x` } ``` ```text warning: a dangling pointer will be produced because the local variable `x` will be dropped --> $DIR/dangling-pointers-from-locals.rs:10:5 | LL | fn simple() -> *const u8 { | --------- return type of the function is `*const u8` LL | let x = 0; | - `x` is defined inside the function and will be drop at the end of the function LL | &x | ^^ | = note: pointers do not have a lifetime; after returning, the `u8` will be deallocated at the end of the function because nothing is referencing it as far as the type system is concerned = note: `#[warn(dangling_pointers_from_locals)]` on by default ``` ### Explanation Returning a pointer from a local value will not prolong its lifetime, which means that the value can be dropped and the allocation freed while the pointer still exists, making the pointer dangling. If you need stronger guarantees, consider using references instead, as they are statically verified by the borrow-checker to never dangle. ------ This is related to GitHub codeql [CWE-825](https://github.com/github/codeql/blob/main/rust/ql/src/queries/security/CWE-825/AccessAfterLifetimeBad.rs) which shows examples of such simple miss-use. It should be noted that C compilers warns against such patterns even without `-Wall`, https://godbolt.org/z/P7z98arrc. ------ `@rustbot` labels +I-lang-nominated +T-lang cc `@traviscross` r? compiler

Rollup of 14 pull requests Successful merges: - #143857 (Port #[macro_export] to the new attribute parsing infrastructure) - #143900 ([rustdoc] Correctly handle `should_panic` doctest attribute and fix `--no-run` test flag on the 2024 edition) - #144070 (Implement `hash_map` macro ) - #144322 (Add lint against dangling pointers from local variables) - #144443 (Make target pointer width in target json an integer) - #144667 (`AlignmentEnum` should just be `repr(usize)` now) - #144779 (Implement debugging output of the bootstrap Step graph into a DOT file) - #144790 (Multiple bounds checking elision failures) - #144794 (Port `#[coroutine]` to the new attribute system) - #144808 (`Interner` arg to `EarlyBinder` does not affect auto traits) - #144816 (Update E0562 to account for the new impl trait positions) - #144822 (Return a struct with named fields from `hash_owner_nodes`) - #144824 (Updated test links in compiler) - #144829 (Use full flag name in strip command for Darwin) r? `@ghost` `@rustbot` modify labels: rollup

…oli-obk Add lint against dangling pointers from local variables ## `dangling_pointers_from_locals` *warn-by-default* The `dangling_pointers_from_locals` lint detects getting a pointer to data of a local that will be dropped at the end of the function. ### Example ```rust fn f() -> *const u8 { let x = 0; &x // returns a dangling ptr to `x` } ``` ```text warning: a dangling pointer will be produced because the local variable `x` will be dropped --> $DIR/dangling-pointers-from-locals.rs:10:5 | LL | fn simple() -> *const u8 { | --------- return type of the function is `*const u8` LL | let x = 0; | - `x` is defined inside the function and will be drop at the end of the function LL | &x | ^^ | = note: pointers do not have a lifetime; after returning, the `u8` will be deallocated at the end of the function because nothing is referencing it as far as the type system is concerned = note: `#[warn(dangling_pointers_from_locals)]` on by default ``` ### Explanation Returning a pointer from a local value will not prolong its lifetime, which means that the value can be dropped and the allocation freed while the pointer still exists, making the pointer dangling. If you need stronger guarantees, consider using references instead, as they are statically verified by the borrow-checker to never dangle. ------ This is related to GitHub codeql [CWE-825](https://github.com/github/codeql/blob/main/rust/ql/src/queries/security/CWE-825/AccessAfterLifetimeBad.rs) which shows examples of such simple miss-use. It should be noted that C compilers warns against such patterns even without `-Wall`, https://godbolt.org/z/P7z98arrc. ------ ``@rustbot`` labels +I-lang-nominated +T-lang cc ``@traviscross`` r? compiler

Rollup of 13 pull requests Successful merges: - #143857 (Port #[macro_export] to the new attribute parsing infrastructure) - #143900 ([rustdoc] Correctly handle `should_panic` doctest attribute and fix `--no-run` test flag on the 2024 edition) - #144070 (Implement `hash_map` macro ) - #144322 (Add lint against dangling pointers from local variables) - #144443 (Make target pointer width in target json an integer) - #144667 (`AlignmentEnum` should just be `repr(usize)` now) - #144790 (Multiple bounds checking elision failures) - #144794 (Port `#[coroutine]` to the new attribute system) - #144808 (`Interner` arg to `EarlyBinder` does not affect auto traits) - #144816 (Update E0562 to account for the new impl trait positions) - #144822 (Return a struct with named fields from `hash_owner_nodes`) - #144824 (Updated test links in compiler) - #144829 (Use full flag name in strip command for Darwin) r? `@ghost` `@rustbot` modify labels: rollup

rustbot assigned oli-obk Jul 22, 2025

traviscross added the P-lang-drag-1 Lang team prioritization drag level 1. https://rust-lang.zulipchat.com/#narrow/channel/410516-t-lang label Jul 22, 2025

This comment has been minimized.

Sign in to view

traviscross removed the T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. label Jul 23, 2025

rfcbot added proposed-final-comment-period Proposed to merge/close by relevant subteam, see T-<team> label. Will enter FCP once signed off. disposition-merge This issue / PR is in PFCP or FCP with a disposition to merge it. labels Jul 23, 2025

rfcbot added final-comment-period In the final comment period and will be merged soon unless new substantive objections are raised. and removed proposed-final-comment-period Proposed to merge/close by relevant subteam, see T-<team> label. Will enter FCP once signed off. labels Jul 23, 2025

Urgau force-pushed the dangling-ptr-from-locals branch 3 times, most recently from 53a1ff8 to bec4fc5 Compare July 26, 2025 16:05

oli-obk requested changes Jul 28, 2025

View reviewed changes

rustbot added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jul 28, 2025

Urgau force-pushed the dangling-ptr-from-locals branch from bec4fc5 to ecb89bc Compare July 28, 2025 17:31

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Jul 28, 2025

oli-obk approved these changes Jul 29, 2025

View reviewed changes

Urgau added 2 commits July 31, 2025 22:35

Add lint against dangling pointers form local variables

8a3a7e6

Allow dangling_pointers_from_locals lint in tests

21ec0d5

Urgau force-pushed the dangling-ptr-from-locals branch from ecb89bc to 21ec0d5 Compare July 31, 2025 20:35

rfcbot added finished-final-comment-period The final comment period is finished for this PR / Issue. to-announce Announce this issue on triage meeting and removed final-comment-period In the final comment period and will be merged soon unless new substantive objections are raised. labels Aug 2, 2025

rustbot mentioned this pull request Aug 2, 2025

Tracking issue for release notes of #144322: Add lint against dangling pointers from local variables #144830

Open

bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Aug 2, 2025

Zalathar mentioned this pull request Aug 3, 2025

Rollup of 14 pull requests #144844

Closed

Zalathar mentioned this pull request Aug 3, 2025

Rollup of 13 pull requests #144845

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add lint against dangling pointers from local variables #144322

Add lint against dangling pointers from local variables #144322

Urgau commented Jul 22, 2025 •

edited

Loading

Uh oh!

This comment has been minimized.

rustbot commented Jul 22, 2025

Uh oh!

traviscross commented Jul 23, 2025

Uh oh!

rfcbot commented Jul 23, 2025 •

edited by traviscross

Loading

Uh oh!

tmandry commented Jul 23, 2025

Uh oh!

rfcbot commented Jul 23, 2025

Uh oh!

scottmcm commented Jul 23, 2025

Uh oh!

oli-obk left a comment

Uh oh!

Uh oh!

oli-obk Jul 28, 2025

Uh oh!

Uh oh!

saethlin commented Jul 28, 2025

Uh oh!

Urgau commented Jul 28, 2025 •

edited

Loading

Uh oh!

oli-obk left a comment

Uh oh!

rfcbot commented Aug 2, 2025

Uh oh!

Urgau commented Aug 2, 2025

Uh oh!

bors commented Aug 2, 2025

Uh oh!

Uh oh!

Add lint against dangling pointers from local variables #144322

Are you sure you want to change the base?

Add lint against dangling pointers from local variables #144322

Conversation

Urgau commented Jul 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

dangling_pointers_from_locals

Example

Explanation

Uh oh!

This comment has been minimized.

rustbot commented Jul 22, 2025

Uh oh!

traviscross commented Jul 23, 2025

Uh oh!

rfcbot commented Jul 23, 2025 • edited by traviscross Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tmandry commented Jul 23, 2025

Uh oh!

rfcbot commented Jul 23, 2025

Uh oh!

scottmcm commented Jul 23, 2025

Uh oh!

oli-obk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

oli-obk Jul 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

saethlin commented Jul 28, 2025

Uh oh!

Urgau commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

oli-obk left a comment

Choose a reason for hiding this comment

Uh oh!

rfcbot commented Aug 2, 2025

Uh oh!

Urgau commented Aug 2, 2025

Uh oh!

bors commented Aug 2, 2025

Uh oh!

Uh oh!

Urgau commented Jul 22, 2025 •

edited

Loading

`dangling_pointers_from_locals`

rfcbot commented Jul 23, 2025 •

edited by traviscross

Loading

Urgau commented Jul 28, 2025 •

edited

Loading