//! Check the validity invariant of a given value, and tell the user //! where in the value it got violated. //! In const context, this goes even further and tries to approximate const safety. //! That's useful because it means other passes (e.g. promotion) can rely on `const`s //! to be const-safe. use std::convert::TryFrom; use std::fmt::Write; use std::num::NonZeroUsize; use rustc_data_structures::fx::FxHashSet; use rustc_hir as hir; use rustc_middle::mir::interpret::InterpError; use rustc_middle::ty; use rustc_middle::ty::layout::{LayoutOf, TyAndLayout}; use rustc_span::symbol::{sym, Symbol}; use rustc_target::abi::{Abi, Scalar as ScalarAbi, Size, VariantIdx, Variants, WrappingRange}; use std::hash::Hash; use super::{ alloc_range, CheckInAllocMsg, GlobalAlloc, InterpCx, InterpResult, MPlaceTy, Machine, MemPlaceMeta, OpTy, ScalarMaybeUninit, ValueVisitor, }; macro_rules! throw_validation_failure { ($where:expr, { $( $what_fmt:expr ),+ } $( expected { $( $expected_fmt:expr ),+ } )?) => {{ let mut msg = String::new(); msg.push_str("encountered "); write!(&mut msg, $($what_fmt),+).unwrap(); $( msg.push_str(", but expected "); write!(&mut msg, $($expected_fmt),+).unwrap(); )? let path = rustc_middle::ty::print::with_no_trimmed_paths(|| { let where_ = &$where; if !where_.is_empty() { let mut path = String::new(); write_path(&mut path, where_); Some(path) } else { None } }); throw_ub!(ValidationFailure { path, msg }) }}; } /// If $e throws an error matching the pattern, throw a validation failure. /// Other errors are passed back to the caller, unchanged -- and if they reach the root of /// the visitor, we make sure only validation errors and `InvalidProgram` errors are left. /// This lets you use the patterns as a kind of validation list, asserting which errors /// can possibly happen: /// /// ``` /// let v = try_validation!(some_fn(), some_path, { /// Foo | Bar | Baz => { "some failure" }, /// }); /// ``` /// /// An additional expected parameter can also be added to the failure message: /// /// ``` /// let v = try_validation!(some_fn(), some_path, { /// Foo | Bar | Baz => { "some failure" } expected { "something that wasn't a failure" }, /// }); /// ``` /// /// An additional nicety is that both parameters actually take format args, so you can just write /// the format string in directly: /// /// ``` /// let v = try_validation!(some_fn(), some_path, { /// Foo | Bar | Baz => { "{:?}", some_failure } expected { "{}", expected_value }, /// }); /// ``` /// macro_rules! try_validation { ($e:expr, $where:expr, $( $( $p:pat )|+ => { $( $what_fmt:expr ),+ } $( expected { $( $expected_fmt:expr ),+ } )? ),+ $(,)? ) => {{ match $e { Ok(x) => x, // We catch the error and turn it into a validation failure. We are okay with // allocation here as this can only slow down builds that fail anyway. Err(e) => match e.kind() { $( $($p)|+ => throw_validation_failure!( $where, { $( $what_fmt ),+ } $( expected { $( $expected_fmt ),+ } )? ) ),+, #[allow(unreachable_patterns)] _ => Err::(e)?, } } }}; } /// We want to show a nice path to the invalid field for diagnostics, /// but avoid string operations in the happy case where no error happens. /// So we track a `Vec` where `PathElem` contains all the data we /// need to later print something for the user. #[derive(Copy, Clone, Debug)] pub enum PathElem { Field(Symbol), Variant(Symbol), GeneratorState(VariantIdx), CapturedVar(Symbol), ArrayElem(usize), TupleElem(usize), Deref, EnumTag, GeneratorTag, DynDowncast, } /// Extra things to check for during validation of CTFE results. pub enum CtfeValidationMode { /// Regular validation, nothing special happening. Regular, /// Validation of a `const`. /// `inner` says if this is an inner, indirect allocation (as opposed to the top-level const /// allocation). Being an inner allocation makes a difference because the top-level allocation /// of a `const` is copied for each use, but the inner allocations are implicitly shared. /// `allow_static_ptrs` says if pointers to statics are permitted (which is the case for promoteds in statics). Const { inner: bool, allow_static_ptrs: bool }, } /// State for tracking recursive validation of references pub struct RefTracking { pub seen: FxHashSet, pub todo: Vec<(T, PATH)>, } impl RefTracking { pub fn empty() -> Self { RefTracking { seen: FxHashSet::default(), todo: vec![] } } pub fn new(op: T) -> Self { let mut ref_tracking_for_consts = RefTracking { seen: FxHashSet::default(), todo: vec![(op, PATH::default())] }; ref_tracking_for_consts.seen.insert(op); ref_tracking_for_consts } pub fn track(&mut self, op: T, path: impl FnOnce() -> PATH) { if self.seen.insert(op) { trace!("Recursing below ptr {:#?}", op); let path = path(); // Remember to come back to this later. self.todo.push((op, path)); } } } /// Format a path fn write_path(out: &mut String, path: &[PathElem]) { use self::PathElem::*; for elem in path.iter() { match elem { Field(name) => write!(out, ".{}", name), EnumTag => write!(out, "."), Variant(name) => write!(out, ".", name), GeneratorTag => write!(out, "."), GeneratorState(idx) => write!(out, ".", idx.index()), CapturedVar(name) => write!(out, ".", name), TupleElem(idx) => write!(out, ".{}", idx), ArrayElem(idx) => write!(out, "[{}]", idx), // `.` does not match Rust syntax, but it is more readable for long paths -- and // some of the other items here also are not Rust syntax. Actually we can't // even use the usual syntax because we are just showing the projections, // not the root. Deref => write!(out, "."), DynDowncast => write!(out, "."), } .unwrap() } } // Formats such that a sentence like "expected something {}" to mean // "expected something " makes sense. fn wrapping_range_format(r: WrappingRange, max_hi: u128) -> String { let WrappingRange { start: lo, end: hi } = r; assert!(hi <= max_hi); if lo > hi { format!("less or equal to {}, or greater or equal to {}", hi, lo) } else if lo == hi { format!("equal to {}", lo) } else if lo == 0 { assert!(hi < max_hi, "should not be printing if the range covers everything"); format!("less or equal to {}", hi) } else if hi == max_hi { assert!(lo > 0, "should not be printing if the range covers everything"); format!("greater or equal to {}", lo) } else { format!("in the range {:?}", r) } } struct ValidityVisitor<'rt, 'mir, 'tcx, M: Machine<'mir, 'tcx>> { /// The `path` may be pushed to, but the part that is present when a function /// starts must not be changed! `visit_fields` and `visit_array` rely on /// this stack discipline. path: Vec, ref_tracking: Option<&'rt mut RefTracking, Vec>>, /// `None` indicates this is not validating for CTFE (but for runtime). ctfe_mode: Option, ecx: &'rt InterpCx<'mir, 'tcx, M>, } impl<'rt, 'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> ValidityVisitor<'rt, 'mir, 'tcx, M> { fn aggregate_field_path_elem(&mut self, layout: TyAndLayout<'tcx>, field: usize) -> PathElem { // First, check if we are projecting to a variant. match layout.variants { Variants::Multiple { tag_field, .. } => { if tag_field == field { return match layout.ty.kind() { ty::Adt(def, ..) if def.is_enum() => PathElem::EnumTag, ty::Generator(..) => PathElem::GeneratorTag, _ => bug!("non-variant type {:?}", layout.ty), }; } } Variants::Single { .. } => {} } // Now we know we are projecting to a field, so figure out which one. match layout.ty.kind() { // generators and closures. ty::Closure(def_id, _) | ty::Generator(def_id, _, _) => { let mut name = None; // FIXME this should be more descriptive i.e. CapturePlace instead of CapturedVar // https://github.com/rust-lang/project-rfc-2229/issues/46 if let Some(local_def_id) = def_id.as_local() { let tables = self.ecx.tcx.typeck(local_def_id); if let Some(captured_place) = tables.closure_min_captures_flattened(*def_id).nth(field) { // Sometimes the index is beyond the number of upvars (seen // for a generator). let var_hir_id = captured_place.get_root_variable(); let node = self.ecx.tcx.hir().get(var_hir_id); if let hir::Node::Binding(pat) = node { if let hir::PatKind::Binding(_, _, ident, _) = pat.kind { name = Some(ident.name); } } } } PathElem::CapturedVar(name.unwrap_or_else(|| { // Fall back to showing the field index. sym::integer(field) })) } // tuples ty::Tuple(_) => PathElem::TupleElem(field), // enums ty::Adt(def, ..) if def.is_enum() => { // we might be projecting *to* a variant, or to a field *in* a variant. match layout.variants { Variants::Single { index } => { // Inside a variant PathElem::Field(def.variants[index].fields[field].ident.name) } Variants::Multiple { .. } => bug!("we handled variants above"), } } // other ADTs ty::Adt(def, _) => PathElem::Field(def.non_enum_variant().fields[field].ident.name), // arrays/slices ty::Array(..) | ty::Slice(..) => PathElem::ArrayElem(field), // dyn traits ty::Dynamic(..) => PathElem::DynDowncast, // nothing else has an aggregate layout _ => bug!("aggregate_field_path_elem: got non-aggregate type {:?}", layout.ty), } } fn with_elem( &mut self, elem: PathElem, f: impl FnOnce(&mut Self) -> InterpResult<'tcx, R>, ) -> InterpResult<'tcx, R> { // Remember the old state let path_len = self.path.len(); // Record new element self.path.push(elem); // Perform operation let r = f(self)?; // Undo changes self.path.truncate(path_len); // Done Ok(r) } fn check_wide_ptr_meta( &mut self, meta: MemPlaceMeta, pointee: TyAndLayout<'tcx>, ) -> InterpResult<'tcx> { let tail = self.ecx.tcx.struct_tail_erasing_lifetimes(pointee.ty, self.ecx.param_env); match tail.kind() { ty::Dynamic(..) => { let vtable = self.ecx.scalar_to_ptr(meta.unwrap_meta()); // Direct call to `check_ptr_access_align` checks alignment even on CTFE machines. try_validation!( self.ecx.memory.check_ptr_access_align( vtable, 3 * self.ecx.tcx.data_layout.pointer_size, // drop, size, align self.ecx.tcx.data_layout.pointer_align.abi, CheckInAllocMsg::InboundsTest, // will anyway be replaced by validity message ), self.path, err_ub!(DanglingIntPointer(..)) | err_ub!(PointerUseAfterFree(..)) => { "dangling vtable pointer in wide pointer" }, err_ub!(AlignmentCheckFailed { .. }) => { "unaligned vtable pointer in wide pointer" }, err_ub!(PointerOutOfBounds { .. }) => { "too small vtable" }, ); try_validation!( self.ecx.read_drop_type_from_vtable(vtable), self.path, err_ub!(DanglingIntPointer(..)) | err_ub!(InvalidFunctionPointer(..)) => { "invalid drop function pointer in vtable (not pointing to a function)" }, err_ub!(InvalidVtableDropFn(..)) => { "invalid drop function pointer in vtable (function has incompatible signature)" }, ); try_validation!( self.ecx.read_size_and_align_from_vtable(vtable), self.path, err_ub!(InvalidVtableSize) => { "invalid vtable: size is bigger than largest supported object" }, err_ub!(InvalidVtableAlignment(msg)) => { "invalid vtable: alignment {}", msg }, err_unsup!(ReadPointerAsBytes) => { "invalid size or align in vtable" }, ); // FIXME: More checks for the vtable. } ty::Slice(..) | ty::Str => { let _len = try_validation!( meta.unwrap_meta().to_machine_usize(self.ecx), self.path, err_unsup!(ReadPointerAsBytes) => { "non-integer slice length in wide pointer" }, ); // We do not check that `len * elem_size <= isize::MAX`: // that is only required for references, and there it falls out of the // "dereferenceable" check performed by Stacked Borrows. } ty::Foreign(..) => { // Unsized, but not wide. } _ => bug!("Unexpected unsized type tail: {:?}", tail), } Ok(()) } /// Check a reference or `Box`. fn check_safe_pointer( &mut self, value: &OpTy<'tcx, M::PointerTag>, kind: &str, ) -> InterpResult<'tcx> { let value = try_validation!( self.ecx.read_immediate(value), self.path, err_unsup!(ReadPointerAsBytes) => { "part of a pointer" } expected { "a proper pointer or integer value" }, ); // Handle wide pointers. // Check metadata early, for better diagnostics let place = try_validation!( self.ecx.ref_to_mplace(&value), self.path, err_ub!(InvalidUninitBytes(None)) => { "uninitialized {}", kind }, ); if place.layout.is_unsized() { self.check_wide_ptr_meta(place.meta, place.layout)?; } // Make sure this is dereferenceable and all. let size_and_align = try_validation!( self.ecx.size_and_align_of_mplace(&place), self.path, err_ub!(InvalidMeta(msg)) => { "invalid {} metadata: {}", kind, msg }, ); let (size, align) = size_and_align // for the purpose of validity, consider foreign types to have // alignment and size determined by the layout (size will be 0, // alignment should take attributes into account). .unwrap_or_else(|| (place.layout.size, place.layout.align.abi)); // Direct call to `check_ptr_access_align` checks alignment even on CTFE machines. try_validation!( self.ecx.memory.check_ptr_access_align( place.ptr, size, align, CheckInAllocMsg::InboundsTest, // will anyway be replaced by validity message ), self.path, err_ub!(AlignmentCheckFailed { required, has }) => { "an unaligned {} (required {} byte alignment but found {})", kind, required.bytes(), has.bytes() }, err_ub!(DanglingIntPointer(0, _)) => { "a null {}", kind }, err_ub!(DanglingIntPointer(i, _)) => { "a dangling {} (address 0x{:x} is unallocated)", kind, i }, err_ub!(PointerOutOfBounds { .. }) => { "a dangling {} (going beyond the bounds of its allocation)", kind }, // This cannot happen during const-eval (because interning already detects // dangling pointers), but it can happen in Miri. err_ub!(PointerUseAfterFree(..)) => { "a dangling {} (use-after-free)", kind }, ); // Recursive checking if let Some(ref mut ref_tracking) = self.ref_tracking { // Proceed recursively even for ZST, no reason to skip them! // `!` is a ZST and we want to validate it. // Skip validation entirely for some external statics if let Ok((alloc_id, _offset, _ptr)) = self.ecx.memory.ptr_try_get_alloc(place.ptr) { // not a ZST let alloc_kind = self.ecx.tcx.get_global_alloc(alloc_id); if let Some(GlobalAlloc::Static(did)) = alloc_kind { assert!(!self.ecx.tcx.is_thread_local_static(did)); assert!(self.ecx.tcx.is_static(did)); if matches!( self.ctfe_mode, Some(CtfeValidationMode::Const { allow_static_ptrs: false, .. }) ) { // See const_eval::machine::MemoryExtra::can_access_statics for why // this check is so important. // This check is reachable when the const just referenced the static, // but never read it (so we never entered `before_access_global`). throw_validation_failure!(self.path, { "a {} pointing to a static variable", kind } ); } // We skip checking other statics. These statics must be sound by // themselves, and the only way to get broken statics here is by using // unsafe code. // The reasons we don't check other statics is twofold. For one, in all // sound cases, the static was already validated on its own, and second, we // trigger cycle errors if we try to compute the value of the other static // and that static refers back to us. // We might miss const-invalid data, // but things are still sound otherwise (in particular re: consts // referring to statics). return Ok(()); } } let path = &self.path; ref_tracking.track(place, || { // We need to clone the path anyway, make sure it gets created // with enough space for the additional `Deref`. let mut new_path = Vec::with_capacity(path.len() + 1); new_path.clone_from(path); new_path.push(PathElem::Deref); new_path }); } Ok(()) } fn read_scalar( &self, op: &OpTy<'tcx, M::PointerTag>, ) -> InterpResult<'tcx, ScalarMaybeUninit> { Ok(try_validation!( self.ecx.read_scalar(op), self.path, err_unsup!(ReadPointerAsBytes) => { "(potentially part of) a pointer" } expected { "plain (non-pointer) bytes" }, )) } /// Check if this is a value of primitive type, and if yes check the validity of the value /// at that type. Return `true` if the type is indeed primitive. fn try_visit_primitive( &mut self, value: &OpTy<'tcx, M::PointerTag>, ) -> InterpResult<'tcx, bool> { // Go over all the primitive types let ty = value.layout.ty; match ty.kind() { ty::Bool => { let value = self.read_scalar(value)?; try_validation!( value.to_bool(), self.path, err_ub!(InvalidBool(..)) | err_ub!(InvalidUninitBytes(None)) => { "{}", value } expected { "a boolean" }, ); Ok(true) } ty::Char => { let value = self.read_scalar(value)?; try_validation!( value.to_char(), self.path, err_ub!(InvalidChar(..)) | err_ub!(InvalidUninitBytes(None)) => { "{}", value } expected { "a valid unicode scalar value (in `0..=0x10FFFF` but not in `0xD800..=0xDFFF`)" }, ); Ok(true) } ty::Float(_) | ty::Int(_) | ty::Uint(_) => { let value = self.read_scalar(value)?; // NOTE: Keep this in sync with the array optimization for int/float // types below! if self.ctfe_mode.is_some() { // Integers/floats in CTFE: Must be scalar bits, pointers are dangerous let is_bits = value.check_init().map_or(false, |v| v.try_to_int().is_ok()); if !is_bits { throw_validation_failure!(self.path, { "{}", value } expected { "initialized plain (non-pointer) bytes" } ) } } else { // At run-time, for now, we accept *anything* for these types, including // uninit. We should fix that, but let's start low. } Ok(true) } ty::RawPtr(..) => { // We are conservative with uninit for integers, but try to // actually enforce the strict rules for raw pointers (mostly because // that lets us re-use `ref_to_mplace`). let place = try_validation!( self.ecx.read_immediate(value).and_then(|ref i| self.ecx.ref_to_mplace(i)), self.path, err_ub!(InvalidUninitBytes(None)) => { "uninitialized raw pointer" }, err_unsup!(ReadPointerAsBytes) => { "part of a pointer" } expected { "a proper pointer or integer value" }, ); if place.layout.is_unsized() { self.check_wide_ptr_meta(place.meta, place.layout)?; } Ok(true) } ty::Ref(_, ty, mutbl) => { if matches!(self.ctfe_mode, Some(CtfeValidationMode::Const { .. })) && *mutbl == hir::Mutability::Mut { // A mutable reference inside a const? That does not seem right (except if it is // a ZST). let layout = self.ecx.layout_of(ty)?; if !layout.is_zst() { throw_validation_failure!(self.path, { "mutable reference in a `const`" }); } } self.check_safe_pointer(value, "reference")?; Ok(true) } ty::Adt(def, ..) if def.is_box() => { self.check_safe_pointer(value, "box")?; Ok(true) } ty::FnPtr(_sig) => { let value = try_validation!( self.ecx.read_immediate(value), self.path, err_unsup!(ReadPointerAsBytes) => { "part of a pointer" } expected { "a proper pointer or integer value" }, ); // Make sure we print a `ScalarMaybeUninit` (and not an `ImmTy`) in the error // message below. let value = value.to_scalar_or_uninit(); let _fn = try_validation!( value.check_init().and_then(|ptr| self.ecx.memory.get_fn(self.ecx.scalar_to_ptr(ptr))), self.path, err_ub!(DanglingIntPointer(..)) | err_ub!(InvalidFunctionPointer(..)) | err_ub!(InvalidUninitBytes(None)) => { "{}", value } expected { "a function pointer" }, ); // FIXME: Check if the signature matches Ok(true) } ty::Never => throw_validation_failure!(self.path, { "a value of the never type `!`" }), ty::Foreign(..) | ty::FnDef(..) => { // Nothing to check. Ok(true) } // The above should be all the primitive types. The rest is compound, we // check them by visiting their fields/variants. ty::Adt(..) | ty::Tuple(..) | ty::Array(..) | ty::Slice(..) | ty::Str | ty::Dynamic(..) | ty::Closure(..) | ty::Generator(..) => Ok(false), // Some types only occur during typechecking, they have no layout. // We should not see them here and we could not check them anyway. ty::Error(_) | ty::Infer(..) | ty::Placeholder(..) | ty::Bound(..) | ty::Param(..) | ty::Opaque(..) | ty::Projection(..) | ty::GeneratorWitness(..) => bug!("Encountered invalid type {:?}", ty), } } fn visit_scalar( &mut self, op: &OpTy<'tcx, M::PointerTag>, scalar_layout: ScalarAbi, ) -> InterpResult<'tcx> { if scalar_layout.valid_range.is_full_for(op.layout.size) { // Nothing to check return Ok(()); } // At least one value is excluded. let valid_range = scalar_layout.valid_range.clone(); let WrappingRange { start, end } = valid_range; let max_value = u128::MAX >> (128 - op.layout.size.bits()); assert!(end <= max_value); // Determine the allowed range let value = self.read_scalar(op)?; let value = try_validation!( value.check_init(), self.path, err_ub!(InvalidUninitBytes(None)) => { "{}", value } expected { "something {}", wrapping_range_format(valid_range, max_value) }, ); let bits = match value.try_to_int() { Err(_) => { // So this is a pointer then, and casting to an int failed. // Can only happen during CTFE. let ptr = self.ecx.scalar_to_ptr(value); if start == 1 && end == max_value { // Only null is the niche. So make sure the ptr is NOT null. if self.ecx.memory.ptr_may_be_null(ptr) { throw_validation_failure!(self.path, { "a potentially null pointer" } expected { "something that cannot possibly fail to be {}", wrapping_range_format(valid_range, max_value) } ) } return Ok(()); } else { // Conservatively, we reject, because the pointer *could* have a bad // value. throw_validation_failure!(self.path, { "a pointer" } expected { "something that cannot possibly fail to be {}", wrapping_range_format(valid_range, max_value) } ) } } Ok(int) => int.assert_bits(op.layout.size), }; // Now compare. This is slightly subtle because this is a special "wrap-around" range. if valid_range.contains(bits) { Ok(()) } else { throw_validation_failure!(self.path, { "{}", bits } expected { "something {}", wrapping_range_format(valid_range, max_value) } ) } } } impl<'rt, 'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> ValueVisitor<'mir, 'tcx, M> for ValidityVisitor<'rt, 'mir, 'tcx, M> { type V = OpTy<'tcx, M::PointerTag>; #[inline(always)] fn ecx(&self) -> &InterpCx<'mir, 'tcx, M> { &self.ecx } fn read_discriminant( &mut self, op: &OpTy<'tcx, M::PointerTag>, ) -> InterpResult<'tcx, VariantIdx> { self.with_elem(PathElem::EnumTag, move |this| { Ok(try_validation!( this.ecx.read_discriminant(op), this.path, err_ub!(InvalidTag(val)) => { "{}", val } expected { "a valid enum tag" }, err_ub!(InvalidUninitBytes(None)) => { "uninitialized bytes" } expected { "a valid enum tag" }, err_unsup!(ReadPointerAsBytes) => { "a pointer" } expected { "a valid enum tag" }, ) .1) }) } #[inline] fn visit_field( &mut self, old_op: &OpTy<'tcx, M::PointerTag>, field: usize, new_op: &OpTy<'tcx, M::PointerTag>, ) -> InterpResult<'tcx> { let elem = self.aggregate_field_path_elem(old_op.layout, field); self.with_elem(elem, move |this| this.visit_value(new_op)) } #[inline] fn visit_variant( &mut self, old_op: &OpTy<'tcx, M::PointerTag>, variant_id: VariantIdx, new_op: &OpTy<'tcx, M::PointerTag>, ) -> InterpResult<'tcx> { let name = match old_op.layout.ty.kind() { ty::Adt(adt, _) => PathElem::Variant(adt.variants[variant_id].ident.name), // Generators also have variants ty::Generator(..) => PathElem::GeneratorState(variant_id), _ => bug!("Unexpected type with variant: {:?}", old_op.layout.ty), }; self.with_elem(name, move |this| this.visit_value(new_op)) } #[inline(always)] fn visit_union( &mut self, _op: &OpTy<'tcx, M::PointerTag>, _fields: NonZeroUsize, ) -> InterpResult<'tcx> { Ok(()) } #[inline] fn visit_value(&mut self, op: &OpTy<'tcx, M::PointerTag>) -> InterpResult<'tcx> { trace!("visit_value: {:?}, {:?}", *op, op.layout); // Check primitive types -- the leafs of our recursive descend. if self.try_visit_primitive(op)? { return Ok(()); } // Sanity check: `builtin_deref` does not know any pointers that are not primitive. assert!(op.layout.ty.builtin_deref(true).is_none()); // Special check preventing `UnsafeCell` in the inner part of constants if let Some(def) = op.layout.ty.ty_adt_def() { if matches!(self.ctfe_mode, Some(CtfeValidationMode::Const { inner: true, .. })) && Some(def.did) == self.ecx.tcx.lang_items().unsafe_cell_type() { throw_validation_failure!(self.path, { "`UnsafeCell` in a `const`" }); } } // Recursively walk the value at its type. self.walk_value(op)?; // *After* all of this, check the ABI. We need to check the ABI to handle // types like `NonNull` where the `Scalar` info is more restrictive than what // the fields say (`rustc_layout_scalar_valid_range_start`). // But in most cases, this will just propagate what the fields say, // and then we want the error to point at the field -- so, first recurse, // then check ABI. // // FIXME: We could avoid some redundant checks here. For newtypes wrapping // scalars, we do the same check on every "level" (e.g., first we check // MyNewtype and then the scalar in there). match op.layout.abi { Abi::Uninhabited => { throw_validation_failure!(self.path, { "a value of uninhabited type {:?}", op.layout.ty } ); } Abi::Scalar(scalar_layout) => { self.visit_scalar(op, scalar_layout)?; } Abi::ScalarPair { .. } | Abi::Vector { .. } => { // These have fields that we already visited above, so we already checked // all their scalar-level restrictions. // There is also no equivalent to `rustc_layout_scalar_valid_range_start` // that would make skipping them here an issue. } Abi::Aggregate { .. } => { // Nothing to do. } } Ok(()) } fn visit_aggregate( &mut self, op: &OpTy<'tcx, M::PointerTag>, fields: impl Iterator>, ) -> InterpResult<'tcx> { match op.layout.ty.kind() { ty::Str => { let mplace = op.assert_mem_place(); // strings are never immediate let len = mplace.len(self.ecx)?; try_validation!( self.ecx.memory.read_bytes(mplace.ptr, Size::from_bytes(len)), self.path, err_ub!(InvalidUninitBytes(..)) => { "uninitialized data in `str`" }, err_unsup!(ReadPointerAsBytes) => { "a pointer in `str`" }, ); } ty::Array(tys, ..) | ty::Slice(tys) // This optimization applies for types that can hold arbitrary bytes (such as // integer and floating point types) or for structs or tuples with no fields. // FIXME(wesleywiser) This logic could be extended further to arbitrary structs // or tuples made up of integer/floating point types or inhabited ZSTs with no // padding. if matches!(tys.kind(), ty::Int(..) | ty::Uint(..) | ty::Float(..)) => { // Optimized handling for arrays of integer/float type. // Arrays cannot be immediate, slices are never immediate. let mplace = op.assert_mem_place(); // This is the length of the array/slice. let len = mplace.len(self.ecx)?; // This is the element type size. let layout = self.ecx.layout_of(tys)?; // This is the size in bytes of the whole array. (This checks for overflow.) let size = layout.size * len; // Optimization: we just check the entire range at once. // NOTE: Keep this in sync with the handling of integer and float // types above, in `visit_primitive`. // In run-time mode, we accept pointers in here. This is actually more // permissive than a per-element check would be, e.g., we accept // a &[u8] that contains a pointer even though bytewise checking would // reject it. However, that's good: We don't inherently want // to reject those pointers, we just do not have the machinery to // talk about parts of a pointer. // We also accept uninit, for consistency with the slow path. let alloc = match self.ecx.memory.get(mplace.ptr, size, mplace.align)? { Some(a) => a, None => { // Size 0, nothing more to check. return Ok(()); } }; match alloc.check_bytes( alloc_range(Size::ZERO, size), /*allow_uninit_and_ptr*/ self.ctfe_mode.is_none(), ) { // In the happy case, we needn't check anything else. Ok(()) => {} // Some error happened, try to provide a more detailed description. Err(err) => { // For some errors we might be able to provide extra information. // (This custom logic does not fit the `try_validation!` macro.) match err.kind() { err_ub!(InvalidUninitBytes(Some((_alloc_id, access)))) => { // Some byte was uninitialized, determine which // element that byte belongs to so we can // provide an index. let i = usize::try_from( access.uninit_offset.bytes() / layout.size.bytes(), ) .unwrap(); self.path.push(PathElem::ArrayElem(i)); throw_validation_failure!(self.path, { "uninitialized bytes" }) } err_unsup!(ReadPointerAsBytes) => { throw_validation_failure!(self.path, { "a pointer" } expected { "plain (non-pointer) bytes" }) } // Propagate upwards (that will also check for unexpected errors). _ => return Err(err), } } } } // Fast path for arrays and slices of ZSTs. We only need to check a single ZST element // of an array and not all of them, because there's only a single value of a specific // ZST type, so either validation fails for all elements or none. ty::Array(tys, ..) | ty::Slice(tys) if self.ecx.layout_of(tys)?.is_zst() => { // Validate just the first element (if any). self.walk_aggregate(op, fields.take(1))? } _ => { self.walk_aggregate(op, fields)? // default handler } } Ok(()) } } impl<'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> InterpCx<'mir, 'tcx, M> { fn validate_operand_internal( &self, op: &OpTy<'tcx, M::PointerTag>, path: Vec, ref_tracking: Option<&mut RefTracking, Vec>>, ctfe_mode: Option, ) -> InterpResult<'tcx> { trace!("validate_operand_internal: {:?}, {:?}", *op, op.layout.ty); // Construct a visitor let mut visitor = ValidityVisitor { path, ref_tracking, ctfe_mode, ecx: self }; // Run it. match visitor.visit_value(&op) { Ok(()) => Ok(()), // Pass through validation failures. Err(err) if matches!(err.kind(), err_ub!(ValidationFailure { .. })) => Err(err), // Also pass through InvalidProgram, those just indicate that we could not // validate and each caller will know best what to do with them. Err(err) if matches!(err.kind(), InterpError::InvalidProgram(_)) => Err(err), // Avoid other errors as those do not show *where* in the value the issue lies. Err(err) => { err.print_backtrace(); bug!("Unexpected error during validation: {}", err); } } } /// This function checks the data at `op` to be const-valid. /// `op` is assumed to cover valid memory if it is an indirect operand. /// It will error if the bits at the destination do not match the ones described by the layout. /// /// `ref_tracking` is used to record references that we encounter so that they /// can be checked recursively by an outside driving loop. /// /// `constant` controls whether this must satisfy the rules for constants: /// - no pointers to statics. /// - no `UnsafeCell` or non-ZST `&mut`. #[inline(always)] pub fn const_validate_operand( &self, op: &OpTy<'tcx, M::PointerTag>, path: Vec, ref_tracking: &mut RefTracking, Vec>, ctfe_mode: CtfeValidationMode, ) -> InterpResult<'tcx> { self.validate_operand_internal(op, path, Some(ref_tracking), Some(ctfe_mode)) } /// This function checks the data at `op` to be runtime-valid. /// `op` is assumed to cover valid memory if it is an indirect operand. /// It will error if the bits at the destination do not match the ones described by the layout. #[inline(always)] pub fn validate_operand(&self, op: &OpTy<'tcx, M::PointerTag>) -> InterpResult<'tcx> { self.validate_operand_internal(op, vec![], None, None) } }