# Rust needs a safe abstraction over uninitialized memory

**URL:** <https://internals.rust-lang.org/t/rust-needs-a-safe-abstraction-over-uninitialized-memory/22254>\
**Category:** language design\
**Created:** [January 26, 2025, 5:21pm UTC](https://internals.rust-lang.org/t/rust-needs-a-safe-abstraction-over-uninitialized-memory/22254 "2025-01-26T17:21:57Z")\
**Posts on this page:** 1\
**Showing post:** 75

<div class="post-metadata">

**Author:** ![Dante-Broggi](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/dante-broggi/32/5798_2.png) [@Dante-Broggi](https://internals.rust-lang.org/u/Dante-Broggi)\
**Post date:** [March 5, 2025, 9:57pm UTC](https://internals.rust-lang.org/t/rust-needs-a-safe-abstraction-over-uninitialized-memory/22254/75 "2025-03-05T21:57:47Z")

</div>

> [@RalfJung](#):
>
> Even if we wanted to change this and somehow extend the scope of `unsafe` to include `freeze`, we'd need a clear (in the mathematical sense) definition of which uses of `freeze` need to be `unsafe` or not. It is not quite clear what that would look like, but it would likely be a form of non-interference. That's a qualitatively different property from UB freedom, so even if we found a clear definition we would now have made the life of everyone who systematically reasons about `unsafe` infinitely harder.

I am just throwing an idea out, but I think it non-rigorously justifies marking `freeze` `unsafe`: Give every initialized byte and primitive (scalar) value a new form of provenance "secrecy-provenance" (distinct from [and a component of] pointer-provenance) that is either:

```rust
demonic // = freeze(uninit))
general // existing values

```

Most operations would propagate this new secrecy-provenance (arithmetic, bit-ops, selection, casts, etc.). Some would conditionally propagate it (vector masking, etc.). But some would cause UB when given values with `demonic` "secrecy-provenance" (I/O primitives, insecure\_free operations, conditionals in near-crypto, etc.).

If we had a time machine, only the UB causing primitives would need to be unsafe. However, as some of these UB causing operations (I/O) are declared safe, as they are safe for all existing values, these new values must be introduced as unsafe-but-valid inhabitants, thus their creation operation (`freeze`) must be `unsafe`.

Of course, adding a new provenance type would require reevaluating all optimizations and make reasoning about generalized code harder, but I think it would be workable in theory.

---

_[View the full topic](https://internals.rust-lang.org/t/rust-needs-a-safe-abstraction-over-uninitialized-memory/22254)._