dyn Allocator together with Allocator + Clone requirements is unsound, leading to UB with Arc

Part 2! This time featuring Clone instead of PartialEq. This one is way worse because Arc relies on it.

#![feature(allocator_api)]

use std::{
    alloc::{Allocator, Global, System},
    sync::Arc,
};

pub trait NewTrait: Allocator {}
impl<A: Allocator> NewTrait for A {}

impl Clone for Box<dyn NewTrait> { // valid because Box is special and `dyn NewTrait` is a local type
    fn clone(&self) -> Self {
        // safe clone impl that violates the safety
        // requirements of Allocator because now,
        // `Self: Allocator + Clone`, but the clone is incompatible
        Box::new(System)
    }
}

use jemallocator::Jemalloc;

#[global_allocator]
static GLOBAL: Jemalloc = Jemalloc;

fn main() {
    let evil_arc = Arc::new_in(69420, Box::new(Global) as Box<dyn NewTrait>);
    let wat = evil_arc.clone(); // clone() returns the wrong allocator
    drop(evil_arc);
    drop(wat); // free(): invalid pointer
}

cc #156882, #156906

I guess Allocator can either not be dyn-compatible or we will need a dedicated unsafe trait AllocatorClone :(

I guess #156917 and this issue just illustrate that doing this:

/// # Safety
/// If this type also implements `MySafeTrait`, then the implementation must satisfy
/// XYZ conditions to avoid UB.
unsafe trait MyUnsafeTrait {}

trait MySafeTrait {}

is fundamentally only possible if MyUnsafeTrait is not dyn compatible.

Pretty much, yeah. This particular case could be kind of avoided if Box<A: Allocator> and &mut A don't impl Allocator, but that seems extremely fragile.

Safety guarantees like this would probably also be extremely dangerous with specialization.

@maxdexh

@maxdexh Please open a PR to add these examples as compile-fail tests. This ensures we do not forget about them in the future if someone tries to make Allocator dyn compatible.

If someone tries to make Allocator dyn compatible.

Non dyn-compatibility is not the only option here. The alternative (which I would honestly prefer since these requirements are also succeptible to future language additions) is a dedicated unsafe Clone trait for allocators.

Rollup merge of rust-lang#157801 - theemathas:allocator-safety-rewrit…

Unrolled build for #157801

Rollup merge of rust-lang#156882 - nia-e:stable-allocator, r=clarfonthey

Unrolled build for #156882 in rollup 163189

Rollup merge of #156882 - nia-e:stable-allocator, r=clarfonthey

Rollup merge of rust-lang#156882 - nia-e:stable-allocator, r=clarfonthey

Navigation Menu

Repository navigation

`dyn Allocator` together with `Allocator + Clone` requirements is unsound, leading to UB with `Arc` #156920

150 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

dyn Allocator together with Allocator + Clone requirements is unsound, leading to UB with Arc #156920

Description

Activity

maxdexh commented on May 25, 2026

Darksonn commented on May 25, 2026

maxdexh commented on May 25, 2026

maxdexh commented on May 25, 2026

Darksonn commented on May 25, 2026

maxdexh commented on May 25, 2026

150 remaining items

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

`dyn Allocator` together with `Allocator + Clone` requirements is unsound, leading to UB with `Arc` #156920