bjoernager/rust
bjoernager/rust
1
Fork 0
Code Activity

Make the stdlib largely conform to strict provenance.

Browse source 
Some things like the unwinders and system APIs are not fully conformant,
this only covers a lot of low-hanging fruit.
This commit is contained in:
Aria Beingessner 2022-03-22 01:24:55 -04:00
parent 5167b6891c
commit c7de289e1c
30 changed files with 100 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

8
library/std/src/backtrace.rs
View file

@ -293,7 +293,7 @@ impl Backtrace {
if !Backtrace::enabled() {
return Backtrace { inner: Inner::Disabled };
}
Backtrace::create(Backtrace::capture as usize)
Backtrace::create((Backtrace::capture as *mut ()).addr())
}
/// Forcibly captures a full backtrace, regardless of environment variable
@ -308,7 +308,7 @@ impl Backtrace {
/// parts of code.
#[inline(never)] // want to make sure there's a frame here to remove
pub fn force_capture() -> Backtrace {
Backtrace::create(Backtrace::force_capture as usize)
Backtrace::create((Backtrace::force_capture as *mut ()).addr())
}
/// Forcibly captures a disabled backtrace, regardless of environment
@ -330,7 +330,7 @@ impl Backtrace {
frame: RawFrame::Actual(frame.clone()),
symbols: Vec::new(),
});
if frame.symbol_address() as usize == ip && actual_start.is_none() {
if frame.symbol_address().addr() == ip && actual_start.is_none() {
actual_start = Some(frames.len());
}
true
@ -493,7 +493,7 @@ impl RawFrame {
match self {
RawFrame::Actual(frame) => frame.ip(),
#[cfg(test)]
RawFrame::Fake => 1 as *mut c_void,
RawFrame::Fake => ptr::invalid_mut(1),
}
}
}

10
library/std/src/io/error/repr_bitpacked.rs
View file

@ -106,7 +106,7 @@ use super::{Custom, ErrorData, ErrorKind, SimpleMessage};
use alloc::boxed::Box;
use core::marker::PhantomData;
use core::mem::{align_of, size_of};
use core::ptr::NonNull;
use core::ptr::{self, NonNull};
// The 2 least-significant bits are used as tag.
const TAG_MASK: usize = 0b11;
@ -136,7 +136,7 @@ impl Repr {
let p = Box::into_raw(b).cast::<u8>();
// Should only be possible if an allocator handed out a pointer with
// wrong alignment.
debug_assert_eq!((p as usize & TAG_MASK), 0);
debug_assert_eq!((p.addr() & TAG_MASK), 0);
// Note: We know `TAG_CUSTOM <= size_of::<Custom>()` (static_assert at
// end of file), and both the start and end of the expression must be
// valid without address space wraparound due to `Box`'s semantics.
@ -166,7 +166,7 @@ impl Repr {
pub(super) fn new_os(code: i32) -> Self {
let utagged = ((code as usize) << 32) | TAG_OS;
// Safety: `TAG_OS` is not zero, so the result of the `|` is not 0.
let res = Self(unsafe { NonNull::new_unchecked(utagged as *mut ()) }, PhantomData);
let res = Self(unsafe { NonNull::new_unchecked(ptr::invalid_mut(utagged)) }, PhantomData);
// quickly smoke-check we encoded the right thing (This generally will
// only run in libstd's tests, unless the user uses -Zbuild-std)
debug_assert!(
@ -180,7 +180,7 @@ impl Repr {
pub(super) fn new_simple(kind: ErrorKind) -> Self {
let utagged = ((kind as usize) << 32) | TAG_SIMPLE;
// Safety: `TAG_SIMPLE` is not zero, so the result of the `|` is not 0.
let res = Self(unsafe { NonNull::new_unchecked(utagged as *mut ()) }, PhantomData);
let res = Self(unsafe { NonNull::new_unchecked(ptr::invalid_mut(utagged)) }, PhantomData);
// quickly smoke-check we encoded the right thing (This generally will
// only run in libstd's tests, unless the user uses -Zbuild-std)
debug_assert!(
@ -238,7 +238,7 @@ unsafe fn decode_repr<C, F>(ptr: NonNull<()>, make_custom: F) -> ErrorData<C>
where
F: FnOnce(*mut Custom) -> C,
{
let bits = ptr.as_ptr() as usize;
let bits = ptr.as_ptr().addr();
match bits & TAG_MASK {
TAG_OS => {
let code = ((bits as i64) >> 32) as i32;

1
library/std/src/lib.rs
View file

@ -275,6 +275,7 @@
#![feature(extend_one)]
#![feature(float_minimum_maximum)]
#![feature(format_args_nl)]
#![feature(strict_provenance)]
#![feature(get_mut_unchecked)]
#![feature(hashmap_internals)]
#![feature(int_error_internals)]

3
library/std/src/os/windows/io/handle.rs
View file

@ -9,6 +9,7 @@ use crate::fs;
use crate::io;
use crate::marker::PhantomData;
use crate::mem::forget;
use crate::ptr;
use crate::sys::c;
use crate::sys::cvt;
use crate::sys_common::{AsInner, FromInner, IntoInner};
@ -182,7 +183,7 @@ impl OwnedHandle {
return unsafe { Ok(Self::from_raw_handle(handle)) };
}
let mut ret = 0 as c::HANDLE;
let mut ret = ptr::null_mut();
cvt(unsafe {
let cur_proc = c::GetCurrentProcess();
c::DuplicateHandle(

1
library/std/src/os/windows/io/socket.rs
View file

@ -129,6 +129,7 @@ impl OwnedSocket {
}
}
// FIXME(strict_provenance_magic): we defined RawSocket to be a u64 ;-;
#[cfg(not(target_vendor = "uwp"))]
pub(crate) fn set_no_inherit(&self) -> io::Result<()> {
cvt(unsafe {

4
library/std/src/path.rs
View file

@ -1449,8 +1449,8 @@ impl PathBuf {
};
// truncate until right after the file stem
let end_file_stem = file_stem[file_stem.len()..].as_ptr() as usize;
let start = os_str_as_u8_slice(&self.inner).as_ptr() as usize;
let end_file_stem = file_stem[file_stem.len()..].as_ptr().addr();
let start = os_str_as_u8_slice(&self.inner).as_ptr().addr();
let v = self.as_mut_vec();
v.truncate(end_file_stem.wrapping_sub(start));

49
library/std/src/sync/once.rs
View file

@ -91,9 +91,12 @@ use crate::cell::Cell;
use crate::fmt;
use crate::marker;
use crate::panic::{RefUnwindSafe, UnwindSafe};
use crate::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
use crate::ptr;
use crate::sync::atomic::{AtomicBool, AtomicPtr, Ordering};
use crate::thread::{self, Thread};
type Masked = ();
/// A synchronization primitive which can be used to run a one-time global
/// initialization. Useful for one-time initialization for FFI or related
/// functionality. This type can only be constructed with [`Once::new()`].
@ -113,7 +116,7 @@ use crate::thread::{self, Thread};
pub struct Once {
// `state_and_queue` is actually a pointer to a `Waiter` with extra state
// bits, so we add the `PhantomData` appropriately.
state_and_queue: AtomicUsize,
state_and_queue: AtomicPtr<Masked>,
_marker: marker::PhantomData<*const Waiter>,
}
@ -136,7 +139,7 @@ impl RefUnwindSafe for Once {}
#[derive(Debug)]
pub struct OnceState {
poisoned: bool,
set_state_on_drop_to: Cell<usize>,
set_state_on_drop_to: Cell<*mut Masked>,
}
/// Initialization value for static [`Once`] values.
@ -184,8 +187,8 @@ struct Waiter {
// Every node is a struct on the stack of a waiting thread.
// Will wake up the waiters when it gets dropped, i.e. also on panic.
struct WaiterQueue<'a> {
state_and_queue: &'a AtomicUsize,
set_state_on_drop_to: usize,
state_and_queue: &'a AtomicPtr<Masked>,
set_state_on_drop_to: *mut Masked,
}
impl Once {
@ -195,7 +198,10 @@ impl Once {
#[rustc_const_stable(feature = "const_once_new", since = "1.32.0")]
#[must_use]
pub const fn new() -> Once {
Once { state_and_queue: AtomicUsize::new(INCOMPLETE), _marker: marker::PhantomData }
Once {
state_and_queue: AtomicPtr::new(ptr::invalid_mut(INCOMPLETE)),
_marker: marker::PhantomData,
}
}
/// Performs an initialization routine once and only once. The given closure
@ -376,7 +382,7 @@ impl Once {
// operations visible to us, and, this being a fast path, weaker
// ordering helps with performance. This `Acquire` synchronizes with
// `Release` operations on the slow path.
self.state_and_queue.load(Ordering::Acquire) == COMPLETE
self.state_and_queue.load(Ordering::Acquire).addr() == COMPLETE
}
// This is a non-generic function to reduce the monomorphization cost of
@ -395,7 +401,7 @@ impl Once {
fn call_inner(&self, ignore_poisoning: bool, init: &mut dyn FnMut(&OnceState)) {
let mut state_and_queue = self.state_and_queue.load(Ordering::Acquire);
loop {
match state_and_queue {
match state_and_queue.addr() {
COMPLETE => break,
POISONED if !ignore_poisoning => {
// Panic to propagate the poison.
@ -405,7 +411,7 @@ impl Once {
// Try to register this thread as the one RUNNING.
let exchange_result = self.state_and_queue.compare_exchange(
state_and_queue,
RUNNING,
ptr::invalid_mut(RUNNING),
Ordering::Acquire,
Ordering::Acquire,
);
@ -417,13 +423,13 @@ impl Once {
// wake them up on drop.
let mut waiter_queue = WaiterQueue {
state_and_queue: &self.state_and_queue,
set_state_on_drop_to: POISONED,
set_state_on_drop_to: ptr::invalid_mut(POISONED),
};
// Run the initialization function, letting it know if we're
// poisoned or not.
let init_state = OnceState {
poisoned: state_and_queue == POISONED,
set_state_on_drop_to: Cell::new(COMPLETE),
poisoned: state_and_queue.addr() == POISONED,
set_state_on_drop_to: Cell::new(ptr::invalid_mut(COMPLETE)),
};
init(&init_state);
waiter_queue.set_state_on_drop_to = init_state.set_state_on_drop_to.get();
@ -432,7 +438,7 @@ impl Once {
_ => {
// All other values must be RUNNING with possibly a
// pointer to the waiter queue in the more significant bits.
assert!(state_and_queue & STATE_MASK == RUNNING);
assert!(state_and_queue.addr() & STATE_MASK == RUNNING);
wait(&self.state_and_queue, state_and_queue);
state_and_queue = self.state_and_queue.load(Ordering::Acquire);
}
@ -441,13 +447,13 @@ impl Once {
}
}
fn wait(state_and_queue: &AtomicUsize, mut current_state: usize) {
fn wait(state_and_queue: &AtomicPtr<Masked>, mut current_state: *mut Masked) {
// Note: the following code was carefully written to avoid creating a
// mutable reference to `node` that gets aliased.
loop {
// Don't queue this thread if the status is no longer running,
// otherwise we will not be woken up.
if current_state & STATE_MASK != RUNNING {
if current_state.addr() & STATE_MASK != RUNNING {
return;
}
@ -455,15 +461,15 @@ fn wait(state_and_queue: &AtomicUsize, mut current_state: usize) {
let node = Waiter {
thread: Cell::new(Some(thread::current())),
signaled: AtomicBool::new(false),
next: (current_state & !STATE_MASK) as *const Waiter,
next: current_state.with_addr(current_state.addr() & !STATE_MASK) as *const Waiter,
};
let me = &node as *const Waiter as usize;
let me = &node as *const Waiter as *const Masked as *mut Masked;
// Try to slide in the node at the head of the linked list, making sure
// that another thread didn't just replace the head of the linked list.
let exchange_result = state_and_queue.compare_exchange(
current_state,
me | RUNNING,
me.with_addr(me.addr() | RUNNING),
Ordering::Release,
Ordering::Relaxed,
);
@ -502,7 +508,7 @@ impl Drop for WaiterQueue<'_> {
self.state_and_queue.swap(self.set_state_on_drop_to, Ordering::AcqRel);
// We should only ever see an old state which was RUNNING.
assert_eq!(state_and_queue & STATE_MASK, RUNNING);
assert_eq!(state_and_queue.addr() & STATE_MASK, RUNNING);
// Walk the entire linked list of waiters and wake them up (in lifo
// order, last to register is first to wake up).
@ -511,7 +517,8 @@ impl Drop for WaiterQueue<'_> {
// free `node` if there happens to be has a spurious wakeup.
// So we have to take out the `thread` field and copy the pointer to
// `next` first.
let mut queue = (state_and_queue & !STATE_MASK) as *const Waiter;
let mut queue =
state_and_queue.with_addr(state_and_queue.addr() & !STATE_MASK) as *const Waiter;
while !queue.is_null() {
let next = (*queue).next;
let thread = (*queue).thread.take().unwrap();
@ -568,6 +575,6 @@ impl OnceState {
/// Poison the associated [`Once`] without explicitly panicking.
// NOTE: This is currently only exposed for the `lazy` module
pub(crate) fn poison(&self) {
self.set_state_on_drop_to.set(POISONED);
self.set_state_on_drop_to.set(ptr::invalid_mut(POISONED));
}
}

2
library/std/src/sys/windows/alloc.rs
View file

@ -159,7 +159,7 @@ unsafe fn allocate(layout: Layout, zeroed: bool) -> *mut u8 {
// Create a correctly aligned pointer offset from the start of the allocated block,
// and write a header before it.
let offset = layout.align() - (ptr as usize & (layout.align() - 1));
let offset = layout.align() - (ptr.addr() & (layout.align() - 1));
// SAFETY: `MIN_ALIGN` <= `offset` <= `layout.align()` and the size of the allocated
// block is `layout.align() + layout.size()`. `aligned` will thus be a correctly aligned
// pointer inside the allocated block with at least `layout.size()` bytes after it and at

2
library/std/src/sys/windows/c.rs
View file

@ -173,7 +173,7 @@ pub const PROGRESS_CONTINUE: DWORD = 0;
pub const E_NOTIMPL: HRESULT = 0x80004001u32 as HRESULT;
pub const INVALID_HANDLE_VALUE: HANDLE = !0 as HANDLE;
pub const INVALID_HANDLE_VALUE: HANDLE = ptr::invalid_mut(!0);
pub const FACILITY_NT_BIT: DWORD = 0x1000_0000;

2
library/std/src/sys/windows/compat.rs
View file

@ -88,7 +88,7 @@ macro_rules! compat_fn {
let symbol_name: *const u8 = concat!(stringify!($symbol), "\0").as_ptr();
let module_handle = $crate::sys::c::GetModuleHandleA(module_name as *const i8);
if !module_handle.is_null() {
match $crate::sys::c::GetProcAddress(module_handle, symbol_name as *const i8) as usize {
match $crate::sys::c::GetProcAddress(module_handle, symbol_name as *const i8).addr() {
0 => {}
n => {
PTR = Some(mem::transmute::<usize, F>(n));

11
library/std/src/sys/windows/fs.rs
View file

@ -57,6 +57,9 @@ pub struct DirEntry {
data: c::WIN32_FIND_DATAW,
}
unsafe impl Send for OpenOptions {}
unsafe impl Sync for OpenOptions {}
#[derive(Clone, Debug)]
pub struct OpenOptions {
// generic
@ -72,7 +75,7 @@ pub struct OpenOptions {
attributes: c::DWORD,
share_mode: c::DWORD,
security_qos_flags: c::DWORD,
security_attributes: usize, // FIXME: should be a reference
security_attributes: c::LPSECURITY_ATTRIBUTES,
}
#[derive(Clone, PartialEq, Eq, Debug)]
@ -187,7 +190,7 @@ impl OpenOptions {
share_mode: c::FILE_SHARE_READ | c::FILE_SHARE_WRITE | c::FILE_SHARE_DELETE,
attributes: 0,
security_qos_flags: 0,
security_attributes: 0,
security_attributes: ptr::null_mut(),
}
}
@ -228,7 +231,7 @@ impl OpenOptions {
self.security_qos_flags = flags | c::SECURITY_SQOS_PRESENT;
}
pub fn security_attributes(&mut self, attrs: c::LPSECURITY_ATTRIBUTES) {
self.security_attributes = attrs as usize;
self.security_attributes = attrs;
}
fn get_access_mode(&self) -> io::Result<c::DWORD> {
@ -289,7 +292,7 @@ impl File {
path.as_ptr(),
opts.get_access_mode()?,
opts.share_mode,
opts.security_attributes as *mut _,
opts.security_attributes,
opts.get_creation_mode()?,
opts.get_flags_and_attributes(),
ptr::null_mut(),

4
library/std/src/sys/windows/mod.rs
View file

@ -136,7 +136,7 @@ pub fn unrolled_find_u16s(needle: u16, haystack: &[u16]) -> Option<usize> {
($($n:literal,)+) => {
$(
if start[$n] == needle {
return Some((&start[$n] as *const u16 as usize - ptr as usize) / 2);
return Some(((&start[$n] as *const u16).addr() - ptr.addr()) / 2);
}
)+
}
@ -149,7 +149,7 @@ pub fn unrolled_find_u16s(needle: u16, haystack: &[u16]) -> Option<usize> {
for c in start {
if *c == needle {
return Some((c as *const u16 as usize - ptr as usize) / 2);
return Some(((c as *const u16).addr() - ptr.addr()) / 2);
}
}
None

2
library/std/src/sys/windows/os.rs
View file

@ -134,7 +134,7 @@ impl Drop for Env {
pub fn env() -> Env {
unsafe {
let ch = c::GetEnvironmentStringsW();
if ch as usize == 0 {
if ch.is_null() {
panic!("failure getting env string from OS: {}", io::Error::last_os_error());
}
Env { base: ch, cur: ch }

12
library/std/src/sys/windows/thread_parker.rs
View file

@ -60,7 +60,7 @@
use crate::convert::TryFrom;
use crate::ptr;
use crate::sync::atomic::{
AtomicI8, AtomicUsize,
AtomicI8, AtomicPtr,
Ordering::{Acquire, Relaxed, Release},
};
use crate::sys::{c, dur2timeout};
@ -217,8 +217,8 @@ impl Parker {
}
fn keyed_event_handle() -> c::HANDLE {
const INVALID: usize = !0;
static HANDLE: AtomicUsize = AtomicUsize::new(INVALID);
const INVALID: c::HANDLE = ptr::invalid_mut(!0);
static HANDLE: AtomicPtr<libc::c_void> = AtomicPtr::new(INVALID);
match HANDLE.load(Relaxed) {
INVALID => {
let mut handle = c::INVALID_HANDLE_VALUE;
@ -233,7 +233,7 @@ fn keyed_event_handle() -> c::HANDLE {
r => panic!("Unable to create keyed event handle: error {r}"),
}
}
match HANDLE.compare_exchange(INVALID, handle as usize, Relaxed, Relaxed) {
match HANDLE.compare_exchange(INVALID, handle, Relaxed, Relaxed) {
Ok(_) => handle,
Err(h) => {
// Lost the race to another thread initializing HANDLE before we did.
@ -241,10 +241,10 @@ fn keyed_event_handle() -> c::HANDLE {
unsafe {
c::CloseHandle(handle);
}
h as c::HANDLE
h
}
}
}
handle => handle as c::HANDLE,
handle => handle,
}
}

12
library/std/src/sys_common/condvar/check.rs
View file

@ -1,4 +1,5 @@
use crate::sync::atomic::{AtomicUsize, Ordering};
use crate::ptr;
use crate::sync::atomic::{AtomicPtr, Ordering};
use crate::sys::locks as imp;
use crate::sys_common::mutex::MovableMutex;
@ -13,17 +14,18 @@ impl CondvarCheck for Box<imp::Mutex> {
}
pub struct SameMutexCheck {
addr: AtomicUsize,
addr: AtomicPtr<()>,
}
#[allow(dead_code)]
impl SameMutexCheck {
pub const fn new() -> Self {
Self { addr: AtomicUsize::new(0) }
Self { addr: AtomicPtr::new(ptr::null_mut()) }
}
pub fn verify(&self, mutex: &MovableMutex) {
let addr = mutex.raw() as *const imp::Mutex as usize;
match self.addr.compare_exchange(0, addr, Ordering::SeqCst, Ordering::SeqCst) {
let addr = mutex.raw() as *const imp::Mutex as *const () as *mut _;
match self.addr.compare_exchange(ptr::null_mut(), addr, Ordering::SeqCst, Ordering::SeqCst)
{
Ok(_) => {} // Stored the address
Err(n) if n == addr => {} // Lost a race to store the same address
_ => panic!("attempted to use a condition variable with two mutexes"),

6
library/std/src/thread/local.rs
View file

@ -1071,7 +1071,7 @@ pub mod os {
pub unsafe fn get(&'static self, init: impl FnOnce() -> T) -> Option<&'static T> {
// SAFETY: See the documentation for this method.
let ptr = unsafe { self.os.get() as *mut Value<T> };
if ptr as usize > 1 {
if ptr.addr() > 1 {
// SAFETY: the check ensured the pointer is safe (its destructor
// is not running) + it is coming from a trusted source (self).
if let Some(ref value) = unsafe { (*ptr).inner.get() } {
@ -1090,7 +1090,7 @@ pub mod os {
// SAFETY: No mutable references are ever handed out meaning getting
// the value is ok.
let ptr = unsafe { self.os.get() as *mut Value<T> };
if ptr as usize == 1 {
if ptr.addr() == 1 {
// destructor is running
return None;
}
@ -1130,7 +1130,7 @@ pub mod os {
unsafe {
let ptr = Box::from_raw(ptr as *mut Value<T>);
let key = ptr.key;
key.os.set(1 as *mut u8);
key.os.set(ptr::invalid_mut(1));
drop(ptr);
key.os.set(ptr::null_mut());
}