Tracking Issue for future-incompatibility lint invalid_c_variadic_arguments #162483

This is the tracking issue for the invalid_c_variadic_arguments future-compatibility warning. The goal of this page is to describe why this change was made and how you can fix code that is affected by it. It also provides a place to ask questions or register a complaint if you feel the change should not be made. For more information on the policy around future-compatibility warnings, see our breaking change policy guidelines.

What is the warning for? Why was this change made?

The invalid_c_variadic_arguments lint detects when a value of an unsupported type is passed as a C-variadic argument (varargs).

Only certain types are supported in C-variadic arguments (varargs). In particular, only types that implement the core::ffi::VaArgSafe trait are supported.

Using unsupported types causes undefined behavior. However, the compiler previously didn't consistently check to prevent this from happening in all cases.

Currently, this lint does not warn on references to Sized types, despite the fact that they (unlike raw pointers) don't implement VaArgSafe. This is because we might decide to officially support them in the future, by making them implement VaArgSafe, and there is too much existing code that passes references as varargs.

Example

unsafe extern "C" fn variadic(_: ...) {}

pub fn foo<T>(x: T) {
    unsafe {
        variadic(x);  // warning: type `T` does not implement `VaArgSafe`
    }
}

Recommendations

If you encounter this lint in a generic context which will be instantiated only with supported types, consider adding a trait bound such as T: VaArgSafe.

Steps

• Implement the lint
• Raise lint level to deny
• Change the lint to report in dependencies
• Switch to a hard error

Implementation history

• Discovery of the issue: Varargs are completely unchecked if passed as generics #61275
• Implementation: Add FCW for invalid C variadic arguments #162478