Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

interpret: ensure we check bool/char for validity when they are used in a cast #126265

Merged
merged 2 commits into from
Jun 11, 2024

Conversation

RalfJung
Copy link
Member

In general, Scalar::to_bits is a bit dangerous as it bypasses all type information. We should usually prefer matching on the type and acting according to that. So I also refactored unary_op handling of integers to do that. The remaining to_bits uses are operations that just fundamentally don't care about the sign (and only work on integers).

invalid_char_cast.rs is the key new test, the others already passed before this PR.

r? @oli-obk

@rustbot rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. labels Jun 11, 2024
@rustbot
Copy link
Collaborator

rustbot commented Jun 11, 2024

Some changes occurred to the CTFE / Miri engine

cc @rust-lang/miri

The Miri subtree was changed

cc @rust-lang/miri

@oli-obk
Copy link
Contributor

oli-obk commented Jun 11, 2024

Will this make

const fn cast(ptr: *const bool) { unsafe {
    let _val = *ptr as u32;
}}

const _: () = {
    let v = 3_u8;
    cast(&v as *const u8 as *const bool);
};

error? (it currently works on stable).

I'm aware we can do breaking changes around UB, and I do not expect anyone to be using this anywhere out there, but we should at least have a test and notify T-lang

@RalfJung
Copy link
Member Author

Yes, that errors now -- I added a test. This clearly manifests a bool value out of the 3 so I think it should definitely be UB.

Cc @rust-lang/opsem @rust-lang/lang

@oli-obk
Copy link
Contributor

oli-obk commented Jun 11, 2024

Agreed.

@bors r

@bors
Copy link
Contributor

bors commented Jun 11, 2024

📌 Commit de4ac0c has been approved by oli-obk

It is now in the queue for this repository.

@bors bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jun 11, 2024
@RalfJung RalfJung added the relnotes Marks issues that should be documented in the release notes of the next release. label Jun 11, 2024
bors added a commit to rust-lang-ci/rust that referenced this pull request Jun 11, 2024
Rollup of 5 pull requests

Successful merges:

 - rust-lang#126186 (Migrate `run-make/multiple-emits` to `rmake.rs`)
 - rust-lang#126236 (Delegation: fix ICE on recursive delegation)
 - rust-lang#126254 (Remove ignore-cross-compile directive from ui/macros/proc_macro)
 - rust-lang#126258 (Do not define opaque types when selecting impls)
 - rust-lang#126265 (interpret: ensure we check bool/char for validity when they are used in a cast)

r? `@ghost`
`@rustbot` modify labels: rollup
@bors bors merged commit cfd48bd into rust-lang:master Jun 11, 2024
6 checks passed
rust-timer added a commit to rust-lang-ci/rust that referenced this pull request Jun 11, 2024
Rollup merge of rust-lang#126265 - RalfJung:interpret-cast-validity, r=oli-obk

interpret: ensure we check bool/char for validity when they are used in a cast

In general, `Scalar::to_bits` is a bit dangerous as it bypasses all type information. We should usually prefer matching on the type and acting according to that. So I also refactored `unary_op` handling of integers to do that. The remaining `to_bits` uses are operations that just fundamentally don't care about the sign (and only work on integers).

invalid_char_cast.rs is the key new test, the others already passed before this PR.

r? `@oli-obk`
@rustbot rustbot added this to the 1.81.0 milestone Jun 11, 2024
@scottmcm
Copy link
Member

(Lang hat on; not speaking for the team)

This change seems clearly fine to me -- a by-value operation on a value of a type outside its validity invariant where that invariant has been clearly communicated for ages.

There might be some more subtle cases of UB where it'd be worth being more cautious, but I don't think this is one of them.

@RalfJung RalfJung deleted the interpret-cast-validity branch June 13, 2024 07:53
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Sep 11, 2024
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [rust](https://github.com/rust-lang/rust) | minor | `1.80.1` -> `1.81.0` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>rust-lang/rust (rust)</summary>

### [`v1.81.0`](https://github.com/rust-lang/rust/blob/HEAD/RELEASES.md#Version-1810-2024-09-05)

[Compare Source](rust-lang/rust@1.80.1...1.81.0)

\==========================

<a id="1.81.0-Language"></a>

## Language

-   [Abort on uncaught panics in `extern "C"` functions.](rust-lang/rust#116088)
-   [Fix ambiguous cases of multiple `&` in elided self lifetimes.](rust-lang/rust#117967)
-   [Stabilize `#[expect]` for lints (RFC 2383),](rust-lang/rust#120924) like `#[allow]` with a warning if the lint is *not* fulfilled.
-   [Change method resolution to constrain hidden types instead of rejecting method candidates.](rust-lang/rust#123962)
-   [Bump `elided_lifetimes_in_associated_constant` to deny.](rust-lang/rust#124211)
-   [`offset_from`: always allow pointers to point to the same address.](rust-lang/rust#124921)
-   [Allow constraining opaque types during subtyping in the trait system.](rust-lang/rust#125447)
-   [Allow constraining opaque types during various unsizing casts.](rust-lang/rust#125610)
-   [Deny keyword lifetimes pre-expansion.](rust-lang/rust#126762)

<a id="1.81.0-Compiler"></a>

## Compiler

-   [Make casts of pointers to trait objects stricter.](rust-lang/rust#120248)
-   [Check alias args for well-formedness even if they have escaping bound vars.](rust-lang/rust#123737)
-   [Deprecate no-op codegen option `-Cinline-threshold=...`.](rust-lang/rust#124712)
-   [Re-implement a type-size based limit.](rust-lang/rust#125507)
-   [Properly account for alignment in `transmute` size checks.](rust-lang/rust#125740)
-   [Remove the `box_pointers` lint.](rust-lang/rust#126018)
-   [Ensure the interpreter checks bool/char for validity when they are used in a cast.](rust-lang/rust#126265)
-   [Improve coverage instrumentation for functions containing nested items.](rust-lang/rust#127199)
-   Target changes:
    -   [Add Tier 3 `no_std` Xtensa targets:](rust-lang/rust#125141) `xtensa-esp32-none-elf`, `xtensa-esp32s2-none-elf`, `xtensa-esp32s3-none-elf`
    -   [Add Tier 3 `std` Xtensa targets:](rust-lang/rust#126380) `xtensa-esp32-espidf`, `xtensa-esp32s2-espidf`, `xtensa-esp32s3-espidf`
    -   [Add Tier 3 i686 Redox OS target:](rust-lang/rust#126192) `i686-unknown-redox`
    -   [Promote `arm64ec-pc-windows-msvc` to Tier 2.](rust-lang/rust#126039)
    -   [Promote `loongarch64-unknown-linux-musl` to Tier 2 with host tools.](rust-lang/rust#126298)
    -   [Enable full tools and profiler for LoongArch Linux targets.](rust-lang/rust#127078)
    -   [Unconditionally warn on usage of `wasm32-wasi`.](rust-lang/rust#126662) (see compatibility note below)
    -   Refer to Rust's \[platform support page]\[platform-support-doc] for more information on Rust's tiered platform support.

<a id="1.81.0-Libraries"></a>

## Libraries

-   [Split core's `PanicInfo` and std's `PanicInfo`.](rust-lang/rust#115974) (see compatibility note below)
-   [Generalize `{Rc,Arc}::make_mut()` to unsized types.](rust-lang/rust#116113)
-   [Replace sort implementations with stable `driftsort` and unstable `ipnsort`.](rust-lang/rust#124032) All `slice::sort*` and `slice::select_nth*` methods are expected to see significant performance improvements. See the [research project](https://github.com/Voultapher/sort-research-rs) for more details.
-   [Document behavior of `create_dir_all` with respect to empty paths.](rust-lang/rust#125112)
-   [Fix interleaved output in the default panic hook when multiple threads panic simultaneously.](rust-lang/rust#127397)

<a id="1.81.0-Stabilized-APIs"></a>

## Stabilized APIs

-   [`core::error`](https://doc.rust-lang.org/stable/core/error/index.html)
-   [`hint::assert_unchecked`](https://doc.rust-lang.org/stable/core/hint/fn.assert_unchecked.html)
-   [`fs::exists`](https://doc.rust-lang.org/stable/std/fs/fn.exists.html)
-   [`AtomicBool::fetch_not`](https://doc.rust-lang.org/stable/core/sync/atomic/struct.AtomicBool.html#method.fetch_not)
-   [`Duration::abs_diff`](https://doc.rust-lang.org/stable/core/time/struct.Duration.html#method.abs_diff)
-   [`IoSlice::advance`](https://doc.rust-lang.org/stable/std/io/struct.IoSlice.html#method.advance)
-   [`IoSlice::advance_slices`](https://doc.rust-lang.org/stable/std/io/struct.IoSlice.html#method.advance_slices)
-   [`IoSliceMut::advance`](https://doc.rust-lang.org/stable/std/io/struct.IoSliceMut.html#method.advance)
-   [`IoSliceMut::advance_slices`](https://doc.rust-lang.org/stable/std/io/struct.IoSliceMut.html#method.advance_slices)
-   [`PanicHookInfo`](https://doc.rust-lang.org/stable/std/panic/struct.PanicHookInfo.html)
-   [`PanicInfo::message`](https://doc.rust-lang.org/stable/core/panic/struct.PanicInfo.html#method.message)
-   [`PanicMessage`](https://doc.rust-lang.org/stable/core/panic/struct.PanicMessage.html)

These APIs are now stable in const contexts:

-   [`char::from_u32_unchecked`](https://doc.rust-lang.org/stable/core/char/fn.from_u32\_unchecked.html) (function)
-   [`char::from_u32_unchecked`](https://doc.rust-lang.org/stable/core/primitive.char.html#method.from_u32\_unchecked) (method)
-   [`CStr::count_bytes`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.count_bytes)
-   [`CStr::from_ptr`](https://doc.rust-lang.org/stable/core/ffi/c_str/struct.CStr.html#method.from_ptr)

<a id="1.81.0-Cargo"></a>

## Cargo

-   [Generated `.cargo_vcs_info.json` is always included, even when `--allow-dirty` is passed.](rust-lang/cargo#13960)
-   [Disallow `package.license-file` and `package.readme` pointing to non-existent files during packaging.](rust-lang/cargo#13921)
-   [Disallow passing `--release`/`--debug` flag along with the `--profile` flag.](rust-lang/cargo#13971)
-   [Remove `lib.plugin` key support in `Cargo.toml`. Rust plugin support has been deprecated for four years and was removed in 1.75.0.](rust-lang/cargo#13902)

<a id="1.81.0-Compatibility-Notes"></a>

## Compatibility Notes

-   Usage of the `wasm32-wasi` target will now issue a compiler warning and request users switch to the `wasm32-wasip1` target instead. Both targets are the same, `wasm32-wasi` is only being renamed, and this [change to the WASI target](https://blog.rust-lang.org/2024/04/09/updates-to-rusts-wasi-targets.html) is being done to enable removing `wasm32-wasi` in January 2025.

-   We have renamed `std::panic::PanicInfo` to `std::panic::PanicHookInfo`. The old name will continue to work as an alias, but will result in a deprecation warning starting in Rust 1.82.0.

    `core::panic::PanicInfo` will remain unchanged, however, as this is now a *different type*.

    The reason is that these types have different roles: `std::panic::PanicHookInfo` is the argument to the [panic hook](https://doc.rust-lang.org/stable/std/panic/fn.set_hook.html) in std context (where panics can have an arbitrary payload), while `core::panic::PanicInfo` is the argument to the [`#[panic_handler]`](https://doc.rust-lang.org/nomicon/panic-handler.html) in no_std context (where panics always carry a formatted *message*). Separating these types allows us to add more useful methods to these types, such as `std::panic::PanicHookInfo::payload_as_str()` and `core::panic::PanicInfo::message()`.

-   The new sort implementations may panic if a type's implementation of [`Ord`](https://doc.rust-lang.org/std/cmp/trait.Ord.html) (or the given comparison function) does not implement a [total order](https://en.wikipedia.org/wiki/Total_order) as the trait requires. `Ord`'s supertraits (`PartialOrd`, `Eq`, and `PartialEq`) must also be consistent. The previous implementations would not "notice" any problem, but the new implementations have a good chance of detecting inconsistencies, throwing a panic rather than returning knowingly unsorted data.

-   [In very rare cases, a change in the internal evaluation order of the trait
    solver may result in new fatal overflow errors.](rust-lang/rust#126128)

<a id="1.81.0-Internal-Changes"></a>

## Internal Changes

These changes do not affect any public interfaces of Rust, but they represent
significant improvements to the performance or internals of rustc and related
tools.

-   [Add a Rust-for Linux `auto` CI job to check kernel builds.](rust-lang/rust#125209)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40NDAuNyIsInVwZGF0ZWRJblZlciI6IjM3LjQ0MC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
relnotes Marks issues that should be documented in the release notes of the next release. S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. T-compiler Relevant to the compiler team, which will review and decide on the PR/issue.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants