Possible Pointer Aliasing Violation in `slice_from_mut_bytes_len`: mutable slice built from `as_ptr()`

[Koukyosyumei]

Hi, I found a possible aliasing/provenance issue in plain-0.2.3 at:

plain/src/methods.rs

Lines 170 to 173 in d9c463e

	Ok(unsafe {
	slice::from_raw_parts_mut(bytes.as_ptr() as *mut T, len)
	})
	}

bytes has type &mut [u8], but the raw pointer used to create the returned &mut [T] is derived from bytes.as_ptr(), i.e. a const/shared raw pointer. Under Miri Tree Borrows, writing through a mutable reference constructed from that pointer can be rejected because the pointer is derived through the shared/frozen access path.

A likely fix is to use as_mut_ptr() instead:

  Ok(unsafe {
      slice::from_raw_parts_mut(bytes.as_mut_ptr() as *mut T, len)
  })

I minimized the pattern to this reproducer:

  use std::slice;

  fn from_mut_bytes_bad(bytes: &mut [u8]) -> &mut [u32] {
      assert_eq!(bytes.as_ptr().align_offset(std::mem::align_of::<u32>()), 0);
      assert!(bytes.len() >= 4);
      unsafe { slice::from_raw_parts_mut(bytes.as_ptr() as *mut u32, 1) }
  }

  fn main() {
      let mut value = 0_u32;
      let bytes = unsafe {
          slice::from_raw_parts_mut((&mut value as *mut u32).cast::<u8>(), 4)
      };

      let words = from_mut_bytes_bad(bytes);
      words[0] = 1;
  }

Running with Tree Borrows:

MIRIFLAGS=-Zmiri-tree-borrows cargo +nightly miri run

reports UB on the write through words[0].

[m4b]

confirmed changing to as_mut_ptr fixes this miri error, For curious the full output I got was:

error: Undefined Behavior: write access through <302> at alloc129[0x0] is forbidden
  --> src/main.rs:14:5
   |
14 |     words[0] = 1;
   |     ^^^^^^^^^^^^ Undefined Behavior occurred here
   |
   = help: this indicates a potential bug in the program: it performed an invalid operation, but the Tree Borrows rules it violated are still experimental
   = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/tree-borrows.md for further information
   = help: the accessed tag <302> is a child of the conflicting tag <293>
   = help: the conflicting tag <293> has state Frozen which forbids this child write access
help: the accessed tag <302> was created here
  --> src/main.rs:13:17
   |
13 |     let words = from_mut_bytes_bad(bytes);
   |                 ^^^^^^^^^^^^^^^^^^^^^^^^^
help: the conflicting tag <293> was created here, in the initial state Frozen
  --> src/main.rs:6:40
   |
 6 |     unsafe { slice::from_raw_parts_mut(bytes.as_ptr() as *mut u32, 1) }
   |                                        ^^^^^^^^^^^^^^
   = note: BACKTRACE (of the first span):
   = note: inside `main` at src/main.rs:14:5: 14:17

[le-jzr]

Hey, thanks for the report! I was pretty busy, but I'm getting familiar with Rust again and will fix this soon. Just reading through the Rustonomicon again after some years. :)