-
-
Notifications
You must be signed in to change notification settings - Fork 14.9k
Unsoundness due to 'static coroutines that yield non-'static values. #144442
Copy link
Copy link
Open
Labels
A-coroutinesArea: CoroutinesArea: CoroutinesA-lifetimesArea: Lifetimes / regionsArea: Lifetimes / regionsC-bugCategory: This is a bug.Category: This is a bug.F-coroutines`#![feature(coroutines)]``#![feature(coroutines)]`I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessT-typesRelevant to the types team, which will review and decide on the PR/issue.Relevant to the types team, which will review and decide on the PR/issue.
Metadata
Metadata
Assignees
Labels
A-coroutinesArea: CoroutinesArea: CoroutinesA-lifetimesArea: Lifetimes / regionsArea: Lifetimes / regionsC-bugCategory: This is a bug.Category: This is a bug.F-coroutines`#![feature(coroutines)]``#![feature(coroutines)]`I-unsoundIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessIssue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/SoundnessT-typesRelevant to the types team, which will review and decide on the PR/issue.Relevant to the types team, which will review and decide on the PR/issue.
Type
Fields
Give feedbackNo fields configured for issues without a type.
This is similar to #112905 and #84366, but it seems different enough so I'm filing a new issue.
The following code causes use-after-free:
The root of the unsoundness here is that the coroutine returned from
make_coromentions the lifetime'ain the body, so the coroutine should not be'static. Yet, rust allows it to be'staticanyway. This allowsextractto transmute the coroutine from one lifetime to another usingAny. The coroutine yields the storage for the payload twice, once before the transmute, and once after. As a result, the storage is treated as two different lifetimes, allowing lifetime extension on arbitrary types.@rustbot labels +I-unsound +requires-nightly +A-coroutines +F-coroutines +A-lifetimes +T-types
Meta
Reproduces on the playground with version
1.90.0-nightly (2025-07-24 b56aaec52bc0fa35591a)