rustc does not warn in a safe fn when a trivially unsafe operation is used on an argument
Open
@rperier is already working on this.
Since Sep 11, 2026.
A-diagnostics
T-compiler
- Dominant language
- Rust
- Stars
- 119k
- Forks
- 16.1k
- PR merge metrics
- PR metrics pending
Description
Code
fn oopsie_woopsie_uwu(ptr: *mut u32) {
unsafe { ptr.write(123); }
}
fn main() {
oopsie_woopsie_uwu(0 as _);
}
Current output
No diagnostics
Desired output
warning: call to function `std::ptr::mut_ptr::<impl *mut T>::write` is unsafe but the pointer is an argument of a safe function
--> src/main.rs:2:7
|
1 | fn oopsie_woopsie_uwu(ptr: *mut u32) {
| ^^^^^^^^^^^^^
| argument declared here
|
2 | { ptr.write(123); }
| ^^^^^^^^^^^^^^ call to unsafe function
|
= note: consult the function's documentation for information on how to avoid undefined behavior
Rationale and extra context
I propose a simple lint warning the developer that the function should be marked unsafe, otherwise preconditions are easily ignored. For now this should only include integers (unchecked_* functions) and pointers (read, write, arithmetic). It should not include struct fields unless the field is marked as pub and is mutable.
It could also include FFI functions that accept a pointer but are marked as safe.
Other cases
Rust Version
1.98.0 (playground)
Anything else?
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.