rustc_const_eval/util/
check_validity_requirement.rs

1use rustc_abi::{BackendRepr, FieldsShape, Scalar, Variants};
2use rustc_middle::ty::layout::{
3    HasTyCtxt, LayoutCx, LayoutError, LayoutOf, TyAndLayout, ValidityRequirement,
4};
5use rustc_middle::ty::{PseudoCanonicalInput, ScalarInt, Ty, TyCtxt};
6use rustc_middle::{bug, ty};
7use rustc_span::DUMMY_SP;
8
9use crate::const_eval::{CanAccessMutGlobal, CheckAlignment, CompileTimeMachine};
10use crate::interpret::{InterpCx, MemoryKind};
11
12/// Determines if this type permits "raw" initialization by just transmuting some memory into an
13/// instance of `T`.
14///
15/// `init_kind` indicates if the memory is zero-initialized or left uninitialized. We assume
16/// uninitialized memory is mitigated by filling it with 0x01, which reduces the chance of causing
17/// LLVM UB.
18///
19/// By default we check whether that operation would cause *LLVM UB*, i.e., whether the LLVM IR we
20/// generate has UB or not. This is a mitigation strategy, which is why we are okay with accepting
21/// Rust UB as long as there is no risk of miscompilations. The `strict_init_checks` can be set to
22/// do a full check against Rust UB instead (in which case we will also ignore the 0x01-filling and
23/// to the full uninit check).
24pub fn check_validity_requirement<'tcx>(
25    tcx: TyCtxt<'tcx>,
26    kind: ValidityRequirement,
27    input: PseudoCanonicalInput<'tcx, Ty<'tcx>>,
28) -> Result<bool, &'tcx LayoutError<'tcx>> {
29    let layout = tcx.layout_of(input)?;
30
31    // There is nothing strict or lax about inhabitedness.
32    if kind == ValidityRequirement::Inhabited {
33        return Ok(!layout.is_uninhabited());
34    }
35
36    let layout_cx = LayoutCx::new(tcx, input.typing_env);
37    if kind == ValidityRequirement::Uninit || tcx.sess.opts.unstable_opts.strict_init_checks {
38        Ok(check_validity_requirement_strict(layout, &layout_cx, kind))
39    } else {
40        check_validity_requirement_lax(layout, &layout_cx, kind)
41    }
42}
43
44/// Implements the 'strict' version of the [`check_validity_requirement`] checks; see that function
45/// for details.
46fn check_validity_requirement_strict<'tcx>(
47    ty: TyAndLayout<'tcx>,
48    cx: &LayoutCx<'tcx>,
49    kind: ValidityRequirement,
50) -> bool {
51    let machine = CompileTimeMachine::new(CanAccessMutGlobal::No, CheckAlignment::Error);
52
53    let mut cx = InterpCx::new(cx.tcx(), DUMMY_SP, cx.typing_env, machine);
54
55    // It doesn't really matter which `MemoryKind` we use here, `Stack` is the least wrong.
56    let allocated =
57        cx.allocate(ty, MemoryKind::Stack).expect("OOM: failed to allocate for uninit check");
58
59    if kind == ValidityRequirement::Zero {
60        cx.write_bytes_ptr(
61            allocated.ptr(),
62            std::iter::repeat_n(0_u8, ty.layout.size().bytes_usize()),
63        )
64        .expect("failed to write bytes for zero valid check");
65    }
66
67    // Assume that if it failed, it's a validation failure.
68    // This does *not* actually check that references are dereferenceable, but since all types that
69    // require dereferenceability also require non-null, we don't actually get any false negatives
70    // due to this.
71    // The value we are validating is temporary and discarded at the end of this function, so
72    // there is no point in resetting provenance and padding.
73    cx.validate_operand(
74        &allocated.into(),
75        /*recursive*/ false,
76        /*reset_provenance_and_padding*/ false,
77    )
78    .discard_err()
79    .is_some()
80}
81
82/// Implements the 'lax' (default) version of the [`check_validity_requirement`] checks; see that
83/// function for details.
84fn check_validity_requirement_lax<'tcx>(
85    this: TyAndLayout<'tcx>,
86    cx: &LayoutCx<'tcx>,
87    init_kind: ValidityRequirement,
88) -> Result<bool, &'tcx LayoutError<'tcx>> {
89    let scalar_allows_raw_init = move |s: Scalar| -> bool {
90        match init_kind {
91            ValidityRequirement::Inhabited => {
92                bug!("ValidityRequirement::Inhabited should have been handled above")
93            }
94            ValidityRequirement::Zero => {
95                // The range must contain 0.
96                s.valid_range(cx).contains(0)
97            }
98            ValidityRequirement::UninitMitigated0x01Fill => {
99                // The range must include an 0x01-filled buffer.
100                let mut val: u128 = 0x01;
101                for _ in 1..s.size(cx).bytes() {
102                    // For sizes >1, repeat the 0x01.
103                    val = (val << 8) | 0x01;
104                }
105                s.valid_range(cx).contains(val)
106            }
107            ValidityRequirement::Uninit => {
108                bug!("ValidityRequirement::Uninit should have been handled above")
109            }
110        }
111    };
112
113    // Check the ABI.
114    let valid = !this.is_uninhabited() // definitely UB if uninhabited
115        && match this.backend_repr {
116            BackendRepr::Scalar(s) => scalar_allows_raw_init(s),
117            BackendRepr::ScalarPair(s1, s2) => {
118                scalar_allows_raw_init(s1) && scalar_allows_raw_init(s2)
119            }
120            BackendRepr::SimdVector { element: s, count } => count == 0 || scalar_allows_raw_init(s),
121            BackendRepr::Memory { .. } => true, // Fields are checked below.
122        };
123    if !valid {
124        // This is definitely not okay.
125        return Ok(false);
126    }
127
128    // Special magic check for references and boxes (i.e., special pointer types).
129    if let Some(pointee) = this.ty.builtin_deref(false) {
130        let pointee = cx.layout_of(pointee)?;
131        // We need to ensure that the LLVM attributes `aligned` and `dereferenceable(size)` are satisfied.
132        if pointee.align.bytes() > 1 {
133            // 0x01-filling is not aligned.
134            return Ok(false);
135        }
136        if pointee.size.bytes() > 0 {
137            // A 'fake' integer pointer is not sufficiently dereferenceable.
138            return Ok(false);
139        }
140    }
141
142    // If we have not found an error yet, we need to recursively descend into fields.
143    match &this.fields {
144        FieldsShape::Primitive | FieldsShape::Union { .. } => {}
145        FieldsShape::Array { .. } => {
146            // Arrays never have scalar layout in LLVM, so if the array is not actually
147            // accessed, there is no LLVM UB -- therefore we can skip this.
148        }
149        FieldsShape::Arbitrary { offsets, .. } => {
150            for idx in 0..offsets.len() {
151                if !check_validity_requirement_lax(this.field(cx, idx), cx, init_kind)? {
152                    // We found a field that is unhappy with this kind of initialization.
153                    return Ok(false);
154                }
155            }
156        }
157    }
158
159    match &this.variants {
160        Variants::Empty => return Ok(false),
161        Variants::Single { .. } => {
162            // All fields of this single variant have already been checked above, there is nothing
163            // else to do.
164        }
165        Variants::Multiple { .. } => {
166            // We cannot tell LLVM anything about the details of this multi-variant layout, so
167            // invalid values "hidden" inside the variant cannot cause LLVM trouble.
168        }
169    }
170
171    Ok(true)
172}
173
174pub(crate) fn validate_scalar_in_layout<'tcx>(
175    tcx: TyCtxt<'tcx>,
176    scalar: ScalarInt,
177    ty: Ty<'tcx>,
178) -> bool {
179    let machine = CompileTimeMachine::new(CanAccessMutGlobal::No, CheckAlignment::Error);
180
181    let typing_env = ty::TypingEnv::fully_monomorphized();
182    let mut cx = InterpCx::new(tcx, DUMMY_SP, typing_env, machine);
183
184    let Ok(layout) = cx.layout_of(ty) else {
185        bug!("could not compute layout of {scalar:?}:{ty:?}")
186    };
187
188    // It doesn't really matter which `MemoryKind` we use here, `Stack` is the least wrong.
189    let allocated =
190        cx.allocate(layout, MemoryKind::Stack).expect("OOM: failed to allocate for uninit check");
191
192    cx.write_scalar(scalar, &allocated).unwrap();
193
194    cx.validate_operand(
195        &allocated.into(),
196        /*recursive*/ false,
197        /*reset_provenance_and_padding*/ false,
198    )
199    .discard_err()
200    .is_some()
201}
rustc_const_eval/util/check_validity_requirement.rs

rustc_const_eval/util/
check_validity_requirement.rs
