Is mutation of a *const casted to *mut UB? Differing behavior for Stacked vs Tree borrows

[olekgierczak]

Is mutating a *const T by casting it to a *mut T and then performing the mutation UB? I wasn't able to find any mentions of this in past issues or any explicit documentation in the rust unsafe guidelines on this. Here's an example that does such a mutation:

fn main() {
  let mut x = 0;
  unsafe {
      let p = &mut x as *const i32;
      let p2 = p as *mut i32;
      *p2 = 1;
  }
  println!("{}", x);
}

Under Tree Borrows, this succeeds, but under Stacked Borrows, it gives an error at the mutation

attempting a write access using <590> at alloc260[0x0], but that tag only grants SharedReadOnly permission for this location

Is it the case that casting through a *const doesn't give a Frozen permission? And if so, is that intentional?

[RalfJung]

This is rust-lang/unsafe-code-guidelines#257. So, definitely known behavior, and at the moment fully intentional -- though it may change either way in the future.

The problem is not the *const T to *mut T cast, the problem is that the initial cast is from &mut T to *const T. If you make this cast to *mut T instead, then you can later cast that raw pointer around in any way you want and both aliasing models will be fine with it.