Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

enable fuzzy_provenance_casts lint in liballoc and libstd #104647

Merged
merged 3 commits into from
Nov 23, 2022
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions library/alloc/benches/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,9 @@
#![feature(iter_next_chunk)]
#![feature(repr_simd)]
#![feature(slice_partition_dedup)]
#![feature(strict_provenance)]
#![feature(test)]
#![deny(fuzzy_provenance_casts)]

extern crate test;

Expand Down
1 change: 1 addition & 0 deletions library/alloc/src/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@
//
// Lints:
#![deny(unsafe_op_in_unsafe_fn)]
#![deny(fuzzy_provenance_casts)]
#![warn(deprecated_in_future)]
#![warn(missing_debug_implementations)]
#![warn(missing_docs)]
Expand Down
13 changes: 7 additions & 6 deletions library/alloc/tests/fmt.rs
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

use std::cell::RefCell;
use std::fmt::{self, Write};
use std::ptr;

#[test]
fn test_format() {
Expand Down Expand Up @@ -76,14 +77,14 @@ fn test_format_macro_interface() {
t!(format!("{}", "foo"), "foo");
t!(format!("{}", "foo".to_string()), "foo");
if cfg!(target_pointer_width = "32") {
t!(format!("{:#p}", 0x1234 as *const isize), "0x00001234");
t!(format!("{:#p}", 0x1234 as *mut isize), "0x00001234");
t!(format!("{:#p}", ptr::invalid::<isize>(0x1234)), "0x00001234");
t!(format!("{:#p}", ptr::invalid_mut::<isize>(0x1234)), "0x00001234");
} else {
t!(format!("{:#p}", 0x1234 as *const isize), "0x0000000000001234");
t!(format!("{:#p}", 0x1234 as *mut isize), "0x0000000000001234");
t!(format!("{:#p}", ptr::invalid::<isize>(0x1234)), "0x0000000000001234");
t!(format!("{:#p}", ptr::invalid_mut::<isize>(0x1234)), "0x0000000000001234");
}
t!(format!("{:p}", 0x1234 as *const isize), "0x1234");
t!(format!("{:p}", 0x1234 as *mut isize), "0x1234");
t!(format!("{:p}", ptr::invalid::<isize>(0x1234)), "0x1234");
t!(format!("{:p}", ptr::invalid_mut::<isize>(0x1234)), "0x1234");
t!(format!("{A:x}"), "aloha");
t!(format!("{B:X}"), "adios");
t!(format!("foo {} ☃☃☃☃☃☃", "bar"), "foo bar ☃☃☃☃☃☃");
Expand Down
1 change: 1 addition & 0 deletions library/alloc/tests/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@
#![feature(strict_provenance)]
#![feature(once_cell)]
#![feature(drain_keep_rest)]
#![deny(fuzzy_provenance_casts)]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A little surprised this is the only lint we turn on in the liballoc tests, but I'll look into that later.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah me too... I briefly tried denying unsafe_op_in_unsafe_fn and got too many red lines to pursue this further right now. ;)


use std::collections::hash_map::DefaultHasher;
use std::hash::{Hash, Hasher};
Expand Down
3 changes: 2 additions & 1 deletion library/std/src/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,7 @@
#![allow(explicit_outlives_requirements)]
#![allow(unused_lifetimes)]
#![deny(rustc::existing_doc_keyword)]
#![deny(fuzzy_provenance_casts)]
// Ensure that std can be linked against panic_abort despite compiled with `-C panic=unwind`
#![deny(ffi_unwind_calls)]
// std may use features in a platform-specific way
Expand Down Expand Up @@ -597,7 +598,7 @@ mod panicking;
mod personality;

#[path = "../../backtrace/src/lib.rs"]
#[allow(dead_code, unused_attributes)]
#[allow(dead_code, unused_attributes, fuzzy_provenance_casts)]
mod backtrace_rs;

// Re-export macros defined in libcore.
Expand Down
1 change: 1 addition & 0 deletions library/std/src/os/windows/io/socket.rs
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,7 @@ impl OwnedSocket {
}

// FIXME(strict_provenance_magic): we defined RawSocket to be a u64 ;-;
#[allow(fuzzy_provenance_casts)]
#[cfg(not(target_vendor = "uwp"))]
pub(crate) fn set_no_inherit(&self) -> io::Result<()> {
cvt(unsafe {
Expand Down
7 changes: 4 additions & 3 deletions library/std/src/personality/dwarf/eh.rs
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@

use super::DwarfReader;
use core::mem;
use core::ptr;

pub const DW_EH_PE_omit: u8 = 0xFF;
pub const DW_EH_PE_absptr: u8 = 0x00;
Expand Down Expand Up @@ -151,7 +152,7 @@ unsafe fn read_encoded_pointer(

// DW_EH_PE_aligned implies it's an absolute pointer value
if encoding == DW_EH_PE_aligned {
reader.ptr = round_up(reader.ptr as usize, mem::size_of::<usize>())? as *const u8;
reader.ptr = reader.ptr.with_addr(round_up(reader.ptr.addr(), mem::size_of::<usize>())?);
return Ok(reader.read::<usize>());
}

Expand All @@ -171,7 +172,7 @@ unsafe fn read_encoded_pointer(
result += match encoding & 0x70 {
DW_EH_PE_absptr => 0,
// relative to address of the encoded value, despite the name
DW_EH_PE_pcrel => reader.ptr as usize,
DW_EH_PE_pcrel => reader.ptr.expose_addr(),
DW_EH_PE_funcrel => {
if context.func_start == 0 {
return Err(());
Expand All @@ -184,7 +185,7 @@ unsafe fn read_encoded_pointer(
};

if encoding & DW_EH_PE_indirect != 0 {
result = *(result as *const usize);
result = *ptr::from_exposed_addr::<usize>(result);
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I hope this can only happen if we previously had the DW_EH_PE_pcrel case above and exposed the pointer...

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Who knows, but given that as *const usize is essentially semantically equivalent to from_exposed_addr::<usize>(...), this shouldn't add additional UB or anything if that's not how it is.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could add UB only if the code relied on the round_up stuff above also exposing the pointer. But that did look like a slam-dunk case for with_addr so I went with that. (Actually it would be an awesome case for map_addr except that it would need ? inside the closure so of course that doesn't work...)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could add UB only if the code relied on the round_up stuff above also exposing the pointer

That would be incredibly goofy and surprising, so I'm going to assume it's not the case.

}

Ok(result)
Expand Down