RustPython · youknowone · Feb 25, 2025 · Feb 21, 2025 · Feb 25, 2025 · Feb 21, 2025
diff --git a/Cargo.toml b/Cargo.toml
@@ -189,6 +189,9 @@ wasm-bindgen = "0.2.100"
 
 [workspace.lints.rust]
 unsafe_code = "allow"
+unsafe_op_in_unsafe_fn = "deny"
+missing_unsafe_on_extern = "deny"
+unsafe_attr_outside_unsafe = "deny"
 
 [workspace.lints.clippy]
 perf = "warn"

diff --git a/common/src/boxvec.rs b/common/src/boxvec.rs
@@ -87,13 +87,16 @@ impl<T> BoxVec<T> {
     pub unsafe fn push_unchecked(&mut self, element: T) {
         let len = self.len();
         debug_assert!(len < self.capacity());
-        ptr::write(self.get_unchecked_ptr(len), element);
-        self.set_len(len + 1);
+        // SAFETY: len < capacity
+        unsafe {
+            ptr::write(self.get_unchecked_ptr(len), element);
+            self.set_len(len + 1);
+        }
     }
 
     /// Get pointer to where element at `index` would be
     unsafe fn get_unchecked_ptr(&mut self, index: usize) -> *mut T {
-        self.xs.as_mut_ptr().add(index).cast()
+        unsafe { self.xs.as_mut_ptr().add(index).cast() }
     }
 
     pub fn insert(&mut self, index: usize, element: T) {
@@ -568,15 +571,15 @@ unsafe fn raw_ptr_add<T>(ptr: *mut T, offset: usize) -> *mut T {
         // Special case for ZST
         (ptr as usize).wrapping_add(offset) as _
     } else {
-        ptr.add(offset)
+        unsafe { ptr.add(offset) }
     }
 }
 
 unsafe fn raw_ptr_write<T>(ptr: *mut T, value: T) {
     if mem::size_of::<T>() == 0 {
         /* nothing */
     } else {
-        ptr::write(ptr, value)
+        unsafe { ptr::write(ptr, value) }
     }
 }
 

diff --git a/common/src/crt_fd.rs b/common/src/crt_fd.rs
@@ -6,7 +6,7 @@ use std::{cmp, ffi, io};
 #[cfg(windows)]
 use libc::commit as fsync;
 #[cfg(windows)]
-extern "C" {
+unsafe extern "C" {
     #[link_name = "_chsize_s"]
     fn ftruncate(fd: i32, len: i64) -> i32;
 }
@@ -74,7 +74,7 @@ impl Fd {
 
     #[cfg(windows)]
     pub fn to_raw_handle(&self) -> io::Result<std::os::windows::io::RawHandle> {
-        extern "C" {
+        unsafe extern "C" {
             fn _get_osfhandle(fd: i32) -> libc::intptr_t;
         }
         let handle = unsafe { suppress_iph!(_get_osfhandle(self.0)) };

diff --git a/common/src/encodings.rs b/common/src/encodings.rs
@@ -42,8 +42,8 @@ struct DecodeError<'a> {
 /// # Safety
 /// `v[..valid_up_to]` must be valid utf8
 unsafe fn make_decode_err(v: &[u8], valid_up_to: usize, err_len: Option<usize>) -> DecodeError<'_> {
-    let valid_prefix = core::str::from_utf8_unchecked(v.get_unchecked(..valid_up_to));
-    let rest = v.get_unchecked(valid_up_to..);
+    let (valid_prefix, rest) = unsafe { v.split_at_unchecked(valid_up_to) };
+    let valid_prefix = unsafe { core::str::from_utf8_unchecked(valid_prefix) };
     DecodeError {
         valid_prefix,
         rest,

diff --git a/common/src/fileutils.rs b/common/src/fileutils.rs
@@ -94,7 +94,7 @@ pub mod windows {
         }
     }
 
-    extern "C" {
+    unsafe extern "C" {
         fn _get_osfhandle(fd: i32) -> libc::intptr_t;
     }
 

diff --git a/common/src/linked_list.rs b/common/src/linked_list.rs
@@ -208,37 +208,39 @@ impl<L: Link> LinkedList<L, L::Target> {
     /// The caller **must** ensure that `node` is currently contained by
     /// `self` or not contained by any other list.
     pub unsafe fn remove(&mut self, node: NonNull<L::Target>) -> Option<L::Handle> {
-        if let Some(prev) = L::pointers(node).as_ref().get_prev() {
-            debug_assert_eq!(L::pointers(prev).as_ref().get_next(), Some(node));
-            L::pointers(prev)
-                .as_mut()
-                .set_next(L::pointers(node).as_ref().get_next());
-        } else {
-            if self.head != Some(node) {
-                return None;
+        unsafe {
+            if let Some(prev) = L::pointers(node).as_ref().get_prev() {
+                debug_assert_eq!(L::pointers(prev).as_ref().get_next(), Some(node));
+                L::pointers(prev)
+                    .as_mut()
+                    .set_next(L::pointers(node).as_ref().get_next());
+            } else {
+                if self.head != Some(node) {
+                    return None;
+                }
+
+                self.head = L::pointers(node).as_ref().get_next();
             }
 
-            self.head = L::pointers(node).as_ref().get_next();
-            }
+            if let Some(next) = L::pointers(node).as_ref().get_next() {
+                debug_assert_eq!(L::pointers(next).as_ref().get_prev(), Some(node));
+                L::pointers(next)
+                    .as_mut()
+                    .set_prev(L::pointers(node).as_ref().get_prev());
+            } else {
+                // // This might be the last item in the list
+                // if self.tail != Some(node) {
+                //     return None;
+                // }
+
+                // self.tail = L::pointers(node).as_ref().get_prev();
+            }
 
-        if let Some(next) = L::pointers(node).as_ref().get_next() {
-            debug_assert_eq!(L::pointers(next).as_ref().get_prev(), Some(node));
-            L::pointers(next)
-                .as_mut()
-                .set_prev(L::pointers(node).as_ref().get_prev());
-        } else {
-            // // This might be the last item in the list
-            // if self.tail != Some(node) {
-            //     return None;
-            // }
+            L::pointers(node).as_mut().set_next(None);
+            L::pointers(node).as_mut().set_prev(None);
 
-            // self.tail = L::pointers(node).as_ref().get_prev();
+            Some(L::from_raw(node))
         }
-
-        L::pointers(node).as_mut().set_next(None);
-        L::pointers(node).as_mut().set_prev(None);
-
-        Some(L::from_raw(node))
     }
 
     // pub fn last(&self) -> Option<&L::Target> {

diff --git a/common/src/lock/cell_lock.rs b/common/src/lock/cell_lock.rs
@@ -140,12 +140,12 @@ unsafe impl RawRwLockUpgrade for RawCellRwLock {
 
     #[inline]
     unsafe fn unlock_upgradable(&self) {
-        self.unlock_shared()
+        unsafe { self.unlock_shared() }
     }
 
     #[inline]
     unsafe fn upgrade(&self) {
-        if !self.try_upgrade() {
+        if !unsafe { self.try_upgrade() } {
             deadlock("upgrade ", "RwLock")
         }
     }

diff --git a/common/src/lock/thread_mutex.rs b/common/src/lock/thread_mutex.rs
@@ -65,7 +65,7 @@ impl<R: RawMutex, G: GetThreadId> RawThreadMutex<R, G> {
     /// This method may only be called if the mutex is held by the current thread.
     pub unsafe fn unlock(&self) {
         self.owner.store(0, Ordering::Relaxed);
-        self.mutex.unlock();
+        unsafe { self.mutex.unlock() };
     }
 }
 

diff --git a/common/src/macros.rs b/common/src/macros.rs
@@ -41,7 +41,7 @@ pub mod __macro_private {
         libc::uintptr_t,
     );
     #[cfg(target_env = "msvc")]
-    extern "C" {
+    unsafe extern "C" {
         pub fn _set_thread_local_invalid_parameter_handler(
             pNew: InvalidParamHandler,
         ) -> InvalidParamHandler;

diff --git a/common/src/os.rs b/common/src/os.rs
@@ -23,7 +23,7 @@ pub fn last_os_error() -> io::Error {
     let err = io::Error::last_os_error();
     // FIXME: probably not ideal, we need a bigger dichotomy between GetLastError and errno
     if err.raw_os_error() == Some(0) {
-        extern "C" {
+        unsafe extern "C" {
             fn _get_errno(pValue: *mut i32) -> i32;
         }
         let mut errno = 0;
@@ -44,7 +44,7 @@ pub fn last_os_error() -> io::Error {
 pub fn last_posix_errno() -> i32 {
     let err = io::Error::last_os_error();
     if err.raw_os_error() == Some(0) {
-        extern "C" {
+        unsafe extern "C" {
             fn _get_errno(pValue: *mut i32) -> i32;
         }
         let mut errno = 0;

diff --git a/compiler/core/src/bytecode.rs b/compiler/core/src/bytecode.rs
@@ -293,10 +293,8 @@ impl<T: OpArgType> Arg<T> {
     /// # Safety
     /// T::from_op_arg(self) must succeed
     pub unsafe fn get_unchecked(self, arg: OpArg) -> T {
-        match T::from_op_arg(arg.0) {
-            Some(t) => t,
-            None => std::hint::unreachable_unchecked(),
-        }
+        // SAFETY: requirements forwarded from caller
+        unsafe { T::from_op_arg(arg.0).unwrap_unchecked() }
     }
 }
 

diff --git a/jit/src/lib.rs b/jit/src/lib.rs
@@ -152,12 +152,14 @@ impl CompiledCode {
     }
 
     unsafe fn invoke_raw(&self, cif_args: &[libffi::middle::Arg]) -> Option<AbiValue> {
-        let cif = self.sig.to_cif();
-        let value = cif.call::<UnTypedAbiValue>(
-            libffi::middle::CodePtr::from_ptr(self.code as *const _),
-            cif_args,
-        );
-        self.sig.ret.as_ref().map(|ty| value.to_typed(ty))
+        unsafe {
+            let cif = self.sig.to_cif();
+            let value = cif.call::<UnTypedAbiValue>(
+                libffi::middle::CodePtr::from_ptr(self.code as *const _),
+                cif_args,
+            );
+            self.sig.ret.as_ref().map(|ty| value.to_typed(ty))
+        }
     }
 }
 
@@ -290,10 +292,12 @@ union UnTypedAbiValue {
 
 impl UnTypedAbiValue {
     unsafe fn to_typed(self, ty: &JitType) -> AbiValue {
-        match ty {
-            JitType::Int => AbiValue::Int(self.int),
-            JitType::Float => AbiValue::Float(self.float),
-            JitType::Bool => AbiValue::Bool(self.boolean != 0),
+        unsafe {
+            match ty {
+                JitType::Int => AbiValue::Int(self.int),
+                JitType::Float => AbiValue::Float(self.float),
+                JitType::Bool => AbiValue::Bool(self.boolean != 0),
+            }
         }
     }
 }

diff --git a/src/lib.rs b/src/lib.rs
@@ -78,7 +78,7 @@ pub fn run(init: impl FnOnce(&mut VirtualMachine) + 'static) -> ExitCode {
     // don't translate newlines (\r\n <=> \n)
     #[cfg(windows)]
     {
-        extern "C" {
+        unsafe extern "C" {
             fn _setmode(fd: i32, flags: i32) -> i32;
         }
         unsafe {

diff --git a/stdlib/src/locale.rs b/stdlib/src/locale.rs
@@ -30,7 +30,7 @@ struct lconv {
 }
 
 #[cfg(windows)]
-extern "C" {
+unsafe extern "C" {
     fn localeconv() -> *mut lconv;
 }
 
@@ -78,11 +78,13 @@ mod _locale {
             return vm.ctx.new_list(group_vec);
         }
 
-        let mut ptr = group;
-        while ![0, libc::c_char::MAX].contains(&*ptr) {
-            let val = vm.ctx.new_int(*ptr);
-            group_vec.push(val.into());
-            ptr = ptr.add(1);
+        unsafe {
+            let mut ptr = group;
+            while ![0, libc::c_char::MAX].contains(&*ptr) {
+                let val = vm.ctx.new_int(*ptr);
+                group_vec.push(val.into());
+                ptr = ptr.add(1);
+            }
         }
         // https://github.com/python/cpython/blob/677320348728ce058fa3579017e985af74a236d4/Modules/_localemodule.c#L80
         if !group_vec.is_empty() {

diff --git a/stdlib/src/select.rs b/stdlib/src/select.rs
@@ -36,28 +36,30 @@ mod platform {
     // based off winsock2.h: https://gist.github.com/piscisaureus/906386#file-winsock2-h-L128-L141
 
     pub unsafe fn FD_SET(fd: RawFd, set: *mut fd_set) {
-        let mut slot = (&raw mut (*set).fd_array).cast::<RawFd>();
-        let fd_count = (*set).fd_count;
-        for _ in 0..fd_count {
-            if *slot == fd {
-                return;
+        unsafe {
+            let mut slot = (&raw mut (*set).fd_array).cast::<RawFd>();
+            let fd_count = (*set).fd_count;
+            for _ in 0..fd_count {
+                if *slot == fd {
+                    return;
+                }
+                slot = slot.add(1);
+            }
+            // slot == &fd_array[fd_count] at this point
+            if fd_count < FD_SETSIZE {
+                *slot = fd as RawFd;
+                (*set).fd_count += 1;
             }
-            slot = slot.add(1);
-        }
-        // slot == &fd_array[fd_count] at this point
-        if fd_count < FD_SETSIZE {
-            *slot = fd as RawFd;
-            (*set).fd_count += 1;
         }
     }
 
     pub unsafe fn FD_ZERO(set: *mut fd_set) {
-        (*set).fd_count = 0;
+        unsafe { (*set).fd_count = 0 };
     }
 
     pub unsafe fn FD_ISSET(fd: RawFd, set: *mut fd_set) -> bool {
         use WinSock::__WSAFDIsSet;
-        __WSAFDIsSet(fd as _, set) != 0
+        unsafe { __WSAFDIsSet(fd as _, set) != 0 }
     }
 
     pub fn check_err(x: i32) -> bool {
@@ -82,7 +84,7 @@ mod platform {
 
     #[allow(non_snake_case)]
     pub unsafe fn FD_ISSET(fd: RawFd, set: *const fd_set) -> bool {
-        let set = &*set;
+        let set = unsafe { &*set };
         let n = set.__nfds;
         for p in &set.__fds[..n] {
             if *p == fd {
@@ -94,7 +96,7 @@ mod platform {
 
     #[allow(non_snake_case)]
     pub unsafe fn FD_SET(fd: RawFd, set: *mut fd_set) {
-        let set = &mut *set;
+        let set = unsafe { &mut *set };
         let n = set.__nfds;
         for p in &set.__fds[..n] {
             if *p == fd {
@@ -107,11 +109,11 @@ mod platform {
 
     #[allow(non_snake_case)]
     pub unsafe fn FD_ZERO(set: *mut fd_set) {
-        let set = &mut *set;
+        let set = unsafe { &mut *set };
         set.__nfds = 0;
     }
 
-    extern "C" {
+    unsafe extern "C" {
         pub fn select(
             nfds: libc::c_int,
             readfds: *mut fd_set,

diff --git a/stdlib/src/socket.rs b/stdlib/src/socket.rs
@@ -1788,7 +1788,7 @@ mod _socket {
     }
 
     unsafe fn slice_as_uninit<T>(v: &mut [T]) -> &mut [MaybeUninit<T>] {
-        &mut *(v as *mut [T] as *mut [MaybeUninit<T>])
+        unsafe { &mut *(v as *mut [T] as *mut [MaybeUninit<T>]) }
     }
 
     enum IoOrPyException {
@@ -2312,12 +2312,12 @@ mod _socket {
         #[cfg(unix)]
         {
             use std::os::unix::io::FromRawFd;
-            Socket::from_raw_fd(fileno)
+            unsafe { Socket::from_raw_fd(fileno) }
         }
         #[cfg(windows)]
         {
             use std::os::windows::io::FromRawSocket;
-            Socket::from_raw_socket(fileno)
+            unsafe { Socket::from_raw_socket(fileno) }
         }
     }
     pub(super) fn sock_fileno(sock: &Socket) -> RawSocket {
-Original file line number
+Diff line change
@@ Expand Up / @@ -94,7 +94,7 @@ pub mod windows { @@
             }
         }
-        extern "C" {
+        unsafe extern "C" {
             fn _get_osfhandle(fd: i32) -> libc::intptr_t;
         }
@@ Expand Down @@