Auditing Unsafe Code

Auditing unsafe code is the systematic review process of verifying that every unsafe block, unsafe fn, and unsafe impl in a crate or dependency tree upholds Rust's memory, aliasing, lifetime, and concurrency invariants under all possible safe inputs—including edge cases like zero-sized types, empty slices, integer overflow, and panicking user callbacks.

The Unsafe Audit Checklist

When reviewing any module containing unsafe, verify these seven failure modes:

Classic Audit Finding: Unwind Double-Free Bug and Fix

Consider a method that moves an element out of a buffer, calls a user closure f(&mut elem), and writes it back. If f panics before the element is written back, and self.len was not adjusted first, the container's Drop implementation will drop the moved slot a second time (double free):

Unsound Sequence on Panic:
  1. `let val = ptr::read(slot);`   (Bitwise copy created; `self.len` still includes `slot`!)
  2. `user_closure(&val);`          (Panics! Unwinding begins!)
  3. `val` is dropped on stack      (Drop #1)
  4. `Container::drop` runs         (Drops `slot` again because `self.len` was not decremented -> Drop #2 = UB!)

Decrementing self.len before calling any potentially panicking code (and only restoring it after the slot is re-initialized) makes the operation unwind-safe:

use std::panic;
use std::ptr;

struct SingleSlot<T> {
    value: std::mem::MaybeUninit<T>,
    initialized: bool,
}

impl<T> SingleSlot<T> {
    fn new(val: T) -> Self {
        Self {
            value: std::mem::MaybeUninit::new(val),
            initialized: true,
        }
    }

    fn transform_unwind_safe(&mut self, f: impl FnOnce(T) -> T) {
        if !self.initialized {
            return;
        }
        // 1. Mark slot as uninitialized BEFORE reading or calling `f`:
        self.initialized = false;
        // SAFETY: `self.initialized` was `true`, so `self.value` is initialized.
        let current = unsafe { self.value.assume_init_read() };

        // 2. If `f(current)` panics here, `current` is dropped once by `f`, and
        //    `SingleSlot::drop` sees `self.initialized == false` (no double-drop!).
        let updated = f(current);

        // 3. Write the updated value back and mark initialized:
        self.value.write(updated);
        self.initialized = true;
    }
}

impl<T> Drop for SingleSlot<T> {
    fn drop(&mut self) {
        if self.initialized {
            // SAFETY: `self.initialized` is true.
            unsafe {
                ptr::drop_in_place(self.value.as_mut_ptr());
            }
        }
    }
}

fn main() {
    let mut slot = SingleSlot::new(String::from("safe"));
    let _ = panic::catch_unwind(panic::AssertUnwindSafe(|| {
        slot.transform_unwind_safe(|_s| panic!("user closure panicked!"));
    }));

    println!("slot.initialized after panic: {}", slot.initialized);
}

slot.initialized after panic: false

Ecosystem Tools for Auditing Unsafe Usage