From 644a5a34dd2f8ccd1c7423ba45931c5afefcdbf2 Mon Sep 17 00:00:00 2001 From: Ralf Jung Date: Sun, 20 Nov 2022 19:07:50 +0100 Subject: [PATCH 1/3] enable fuzzy_provenance_casts lint in liballoc --- library/alloc/benches/lib.rs | 2 ++ library/alloc/src/lib.rs | 1 + library/alloc/tests/fmt.rs | 13 +++++++------ library/alloc/tests/lib.rs | 1 + 4 files changed, 11 insertions(+), 6 deletions(-) diff --git a/library/alloc/benches/lib.rs b/library/alloc/benches/lib.rs index d418965cd2f6b..b25d63d835b54 100644 --- a/library/alloc/benches/lib.rs +++ b/library/alloc/benches/lib.rs @@ -5,7 +5,9 @@ #![feature(iter_next_chunk)] #![feature(repr_simd)] #![feature(slice_partition_dedup)] +#![feature(strict_provenance)] #![feature(test)] +#![deny(fuzzy_provenance_casts)] extern crate test; diff --git a/library/alloc/src/lib.rs b/library/alloc/src/lib.rs index 008926666c136..a9f2873faf97e 100644 --- a/library/alloc/src/lib.rs +++ b/library/alloc/src/lib.rs @@ -82,6 +82,7 @@ // // Lints: #![deny(unsafe_op_in_unsafe_fn)] +#![deny(fuzzy_provenance_casts)] #![warn(deprecated_in_future)] #![warn(missing_debug_implementations)] #![warn(missing_docs)] diff --git a/library/alloc/tests/fmt.rs b/library/alloc/tests/fmt.rs index 5ee6db43fda24..04da95bbb83ed 100644 --- a/library/alloc/tests/fmt.rs +++ b/library/alloc/tests/fmt.rs @@ -2,6 +2,7 @@ use std::cell::RefCell; use std::fmt::{self, Write}; +use std::ptr; #[test] fn test_format() { @@ -76,14 +77,14 @@ fn test_format_macro_interface() { t!(format!("{}", "foo"), "foo"); t!(format!("{}", "foo".to_string()), "foo"); if cfg!(target_pointer_width = "32") { - t!(format!("{:#p}", 0x1234 as *const isize), "0x00001234"); - t!(format!("{:#p}", 0x1234 as *mut isize), "0x00001234"); + t!(format!("{:#p}", ptr::invalid::(0x1234)), "0x00001234"); + t!(format!("{:#p}", ptr::invalid_mut::(0x1234)), "0x00001234"); } else { - t!(format!("{:#p}", 0x1234 as *const isize), "0x0000000000001234"); - t!(format!("{:#p}", 0x1234 as *mut isize), "0x0000000000001234"); + t!(format!("{:#p}", ptr::invalid::(0x1234)), "0x0000000000001234"); + t!(format!("{:#p}", ptr::invalid_mut::(0x1234)), "0x0000000000001234"); } - t!(format!("{:p}", 0x1234 as *const isize), "0x1234"); - t!(format!("{:p}", 0x1234 as *mut isize), "0x1234"); + t!(format!("{:p}", ptr::invalid::(0x1234)), "0x1234"); + t!(format!("{:p}", ptr::invalid_mut::(0x1234)), "0x1234"); t!(format!("{A:x}"), "aloha"); t!(format!("{B:X}"), "adios"); t!(format!("foo {} ☃☃☃☃☃☃", "bar"), "foo bar ☃☃☃☃☃☃"); diff --git a/library/alloc/tests/lib.rs b/library/alloc/tests/lib.rs index ffc5ca7a5c6cc..d066ec03ee57e 100644 --- a/library/alloc/tests/lib.rs +++ b/library/alloc/tests/lib.rs @@ -47,6 +47,7 @@ #![feature(strict_provenance)] #![feature(once_cell)] #![feature(drain_keep_rest)] +#![deny(fuzzy_provenance_casts)] use std::collections::hash_map::DefaultHasher; use std::hash::{Hash, Hasher}; From 7f5adddb2528be322c02cea44137d4192db3b8d5 Mon Sep 17 00:00:00 2001 From: Ralf Jung Date: Sun, 20 Nov 2022 19:10:50 +0100 Subject: [PATCH 2/3] enable fuzzy_provenance_casts lint in libstd --- library/std/src/lib.rs | 3 ++- library/std/src/os/windows/io/socket.rs | 1 + library/std/src/personality/dwarf/eh.rs | 7 ++++--- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/library/std/src/lib.rs b/library/std/src/lib.rs index 9334c833bb650..3eecfa806b564 100644 --- a/library/std/src/lib.rs +++ b/library/std/src/lib.rs @@ -220,6 +220,7 @@ #![allow(explicit_outlives_requirements)] #![allow(unused_lifetimes)] #![deny(rustc::existing_doc_keyword)] +#![deny(fuzzy_provenance_casts)] // Ensure that std can be linked against panic_abort despite compiled with `-C panic=unwind` #![deny(ffi_unwind_calls)] // std may use features in a platform-specific way @@ -597,7 +598,7 @@ mod panicking; mod personality; #[path = "../../backtrace/src/lib.rs"] -#[allow(dead_code, unused_attributes)] +#[allow(dead_code, unused_attributes, fuzzy_provenance_casts)] mod backtrace_rs; // Re-export macros defined in libcore. diff --git a/library/std/src/os/windows/io/socket.rs b/library/std/src/os/windows/io/socket.rs index 72cb3406dcada..5c1634084a055 100644 --- a/library/std/src/os/windows/io/socket.rs +++ b/library/std/src/os/windows/io/socket.rs @@ -90,6 +90,7 @@ impl OwnedSocket { } // FIXME(strict_provenance_magic): we defined RawSocket to be a u64 ;-; + #[allow(fuzzy_provenance_casts)] #[cfg(not(target_vendor = "uwp"))] pub(crate) fn set_no_inherit(&self) -> io::Result<()> { cvt(unsafe { diff --git a/library/std/src/personality/dwarf/eh.rs b/library/std/src/personality/dwarf/eh.rs index 27b50c13b77ca..a783e187004fc 100644 --- a/library/std/src/personality/dwarf/eh.rs +++ b/library/std/src/personality/dwarf/eh.rs @@ -13,6 +13,7 @@ use super::DwarfReader; use core::mem; +use core::ptr; pub const DW_EH_PE_omit: u8 = 0xFF; pub const DW_EH_PE_absptr: u8 = 0x00; @@ -151,7 +152,7 @@ unsafe fn read_encoded_pointer( // DW_EH_PE_aligned implies it's an absolute pointer value if encoding == DW_EH_PE_aligned { - reader.ptr = round_up(reader.ptr as usize, mem::size_of::())? as *const u8; + reader.ptr = reader.ptr.with_addr(round_up(reader.ptr.addr(), mem::size_of::())?); return Ok(reader.read::()); } @@ -171,7 +172,7 @@ unsafe fn read_encoded_pointer( result += match encoding & 0x70 { DW_EH_PE_absptr => 0, // relative to address of the encoded value, despite the name - DW_EH_PE_pcrel => reader.ptr as usize, + DW_EH_PE_pcrel => reader.ptr.expose_addr(), DW_EH_PE_funcrel => { if context.func_start == 0 { return Err(()); @@ -184,7 +185,7 @@ unsafe fn read_encoded_pointer( }; if encoding & DW_EH_PE_indirect != 0 { - result = *(result as *const usize); + result = *ptr::from_exposed_addr::(result); } Ok(result) From 1a6966602a06bb85d1952027e990d72f6d01792f Mon Sep 17 00:00:00 2001 From: Ralf Jung Date: Mon, 21 Nov 2022 16:10:56 +0100 Subject: [PATCH 3/3] dont attempt strict provenance in SGX --- library/std/src/sys/sgx/mod.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/library/std/src/sys/sgx/mod.rs b/library/std/src/sys/sgx/mod.rs index b1d32929ecfde..01e4ffe3dfc8a 100644 --- a/library/std/src/sys/sgx/mod.rs +++ b/library/std/src/sys/sgx/mod.rs @@ -3,6 +3,7 @@ //! This module contains the facade (aka platform-specific) implementations of //! OS level functionality for Fortanix SGX. #![deny(unsafe_op_in_unsafe_fn)] +#![allow(fuzzy_provenance_casts)] // FIXME: this entire module systematically confuses pointers and integers use crate::io::ErrorKind; use crate::sync::atomic::{AtomicBool, Ordering};