On Mon Oct 19, 2026 at 5:13 PM BST, Gary Guo wrote: > On Wed Sep 9, 2026 at 7:44 AM BST, Alistair Popple wrote: >> The closure passed to registration_data_with() currently receives >> `Pin<&'a F::Of<'a>>` with `'a` universally quantified. This prevents the >> closure from returning references derived from the registration data, >> even for sub-fields that are covariant in their lifetime, because the >> compiler cannot relate `'a` to any lifetime the caller knows about. >> >> Tie the outer reference to the `&self` lifetime instead, i.e. pass >> `Pin<&'this F::Of<'a>>`. This gives the closure the implied bound >> `'a: 'this`, so covariant sub-fields such as `&'a T` can be coerced to >> `'this` and returned directly, while invariant fields still cannot be >> coerced and therefore cannot escape with an incorrect lifetime. >> >> This allows auxiliary child drivers to project covariant data out of >> invariant registration data without having to wrap every use in a >> closure. > > Looking at this again I think the current API might be unsound where this > patch > becomes fix rather than just a feature update. > > For an invariant `&'b F::Of<'a>`, it's actually a requirement that `'a` > strictly > outlive `'b`. With the current API surface, we can obtain a `&'a F::Of<'a>`, > then we can store it inside `F::Of<'a>` (because, well, F::Of<'a> being > invariant, it can internally have a `Mutex<Option<F::Of<'a>>`), and then we're > able to UAF within the destruction code of `F::Of<'a>`. > > The fix, is, well, this patch. > > Would you might pulling this patch out, rework the commit message a bit and > send > as a standalone fix? > > Best, > Gary
Ah, I am looking at an old thread, this has been merged now. Ignore the message please. Best, Gary
