Re: [PATCH v6 01/13] rust: auxiliary: let registration_data_with() closures return covariant sub-fields

["Gary Guo" <gary@garyguo.net>]

On Mon Oct 19, 2026 at 5:13 PM BST, Gary Guo wrote:
> On Wed Sep 9, 2026 at 7:44 AM BST, Alistair Popple wrote:
>> The closure passed to registration_data_with() currently receives
>> `Pin<&'a F::Of<'a>>` with `'a` universally quantified. This prevents the
>> closure from returning references derived from the registration data,
>> even for sub-fields that are covariant in their lifetime, because the
>> compiler cannot relate `'a` to any lifetime the caller knows about.
>>
>> Tie the outer reference to the `&self` lifetime instead, i.e. pass
>> `Pin<&'this F::Of<'a>>`. This gives the closure the implied bound
>> `'a: 'this`, so covariant sub-fields such as `&'a T` can be coerced to
>> `'this` and returned directly, while invariant fields still cannot be
>> coerced and therefore cannot escape with an incorrect lifetime.
>>
>> This allows auxiliary child drivers to project covariant data out of
>> invariant registration data without having to wrap every use in a
>> closure.
>
> Looking at this again I think the current API might be unsound where this patch
> becomes fix rather than just a feature update.
>
> For an invariant `&'b F::Of<'a>`, it's actually a requirement that `'a` strictly
> outlive `'b`. With the current API surface, we can obtain a `&'a F::Of<'a>`,
> then we can store it inside `F::Of<'a>` (because, well, F::Of<'a> being
> invariant, it can internally have a `Mutex<Option<F::Of<'a>>`), and then we're
> able to UAF within the destruction code of `F::Of<'a>`.
>
> The fix, is, well, this patch.
>
> Would you might pulling this patch out, rework the commit message a bit and send
> as a standalone fix?
>
> Best,
> Gary

Ah, I am looking at an old thread, this has been merged now.

Ignore the message please.

Best,
Gary