Skip to content

Commit b151b51

Browse files
committed
Insert null checks for pointer dereferences when debug assertions are enabled
Similar to how the alignment is already checked, this adds a check for null pointer dereferences in debug mode. It is implemented similarly to the alignment check as a MirPass. This is related to a 2025H1 project goal for better UB checks in debug mode: rust-lang/rust-project-goals#177.
1 parent 851322b commit b151b51

File tree

32 files changed

+281
-6
lines changed

32 files changed

+281
-6
lines changed

compiler/rustc_codegen_cranelift/src/base.rs

+10
Original file line numberDiff line numberDiff line change
@@ -417,6 +417,16 @@ fn codegen_fn_body(fx: &mut FunctionCx<'_, '_, '_>, start_block: Block) {
417417
Some(source_info.span),
418418
);
419419
}
420+
AssertKind::NullPointerDereference => {
421+
let location = fx.get_caller_location(source_info).load_scalar(fx);
422+
423+
codegen_panic_inner(
424+
fx,
425+
rustc_hir::LangItem::PanicNullPointerDereference,
426+
&[location],
427+
Some(source_info.span),
428+
)
429+
}
420430
_ => {
421431
let location = fx.get_caller_location(source_info).load_scalar(fx);
422432

compiler/rustc_codegen_ssa/src/mir/block.rs

+5
Original file line numberDiff line numberDiff line change
@@ -713,6 +713,11 @@ impl<'a, 'tcx, Bx: BuilderMethods<'a, 'tcx>> FunctionCx<'a, 'tcx, Bx> {
713713
// and `#[track_caller]` adds an implicit third argument.
714714
(LangItem::PanicMisalignedPointerDereference, vec![required, found, location])
715715
}
716+
AssertKind::NullPointerDereference => {
717+
// It's `fn panic_null_pointer_dereference()`,
718+
// `#[track_caller]` adds an implicit argument.
719+
(LangItem::PanicNullPointerDereference, vec![location])
720+
}
716721
_ => {
717722
// It's `pub fn panic_...()` and `#[track_caller]` adds an implicit argument.
718723
(msg.panic_function(), vec![location])

compiler/rustc_const_eval/src/const_eval/machine.rs

+1
Original file line numberDiff line numberDiff line change
@@ -508,6 +508,7 @@ impl<'tcx> interpret::Machine<'tcx> for CompileTimeMachine<'tcx> {
508508
found: eval_to_int(found)?,
509509
}
510510
}
511+
NullPointerDereference => NullPointerDereference,
511512
};
512513
Err(ConstEvalErrKind::AssertFailure(err)).into()
513514
}

compiler/rustc_hir/src/lang_items.rs

+1
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,7 @@ language_item_table! {
316316
PanicAsyncFnResumedPanic, sym::panic_const_async_fn_resumed_panic, panic_const_async_fn_resumed_panic, Target::Fn, GenericRequirement::None;
317317
PanicAsyncGenFnResumedPanic, sym::panic_const_async_gen_fn_resumed_panic, panic_const_async_gen_fn_resumed_panic, Target::Fn, GenericRequirement::None;
318318
PanicGenFnNonePanic, sym::panic_const_gen_fn_none_panic, panic_const_gen_fn_none_panic, Target::Fn, GenericRequirement::None;
319+
PanicNullPointerDereference, sym::panic_null_pointer_dereference, panic_null_pointer_dereference, Target::Fn, GenericRequirement::None;
319320
/// libstd panic entry point. Necessary for const eval to be able to catch it
320321
BeginPanic, sym::begin_panic, begin_panic_fn, Target::Fn, GenericRequirement::None;
321322

compiler/rustc_middle/messages.ftl

+3
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ middle_assert_gen_resume_after_panic = `gen` fn or block cannot be further itera
1717
middle_assert_misaligned_ptr_deref =
1818
misaligned pointer dereference: address must be a multiple of {$required} but is {$found}
1919
20+
middle_assert_null_ptr_deref =
21+
null pointer dereference occurred
22+
2023
middle_assert_op_overflow =
2124
attempt to compute `{$left} {$op} {$right}`, which would overflow
2225

compiler/rustc_middle/src/mir/syntax.rs

+1
Original file line numberDiff line numberDiff line change
@@ -1076,6 +1076,7 @@ pub enum AssertKind<O> {
10761076
ResumedAfterReturn(CoroutineKind),
10771077
ResumedAfterPanic(CoroutineKind),
10781078
MisalignedPointerDereference { required: O, found: O },
1079+
NullPointerDereference,
10791080
}
10801081

10811082
#[derive(Clone, Debug, PartialEq, TyEncodable, TyDecodable, Hash, HashStable)]

compiler/rustc_middle/src/mir/terminator.rs

+4-2
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,7 @@ impl<O> AssertKind<O> {
206206
ResumedAfterPanic(CoroutineKind::Desugared(CoroutineDesugaring::Gen, _)) => {
207207
LangItem::PanicGenFnNonePanic
208208
}
209+
NullPointerDereference => LangItem::PanicNullPointerDereference,
209210

210211
BoundsCheck { .. } | MisalignedPointerDereference { .. } => {
211212
bug!("Unexpected AssertKind")
@@ -271,6 +272,7 @@ impl<O> AssertKind<O> {
271272
"\"misaligned pointer dereference: address must be a multiple of {{}} but is {{}}\", {required:?}, {found:?}"
272273
)
273274
}
275+
NullPointerDereference => write!(f, "\"null pointer dereference occured\""),
274276
ResumedAfterReturn(CoroutineKind::Coroutine(_)) => {
275277
write!(f, "\"coroutine resumed after completion\"")
276278
}
@@ -341,7 +343,7 @@ impl<O> AssertKind<O> {
341343
ResumedAfterPanic(CoroutineKind::Coroutine(_)) => {
342344
middle_assert_coroutine_resume_after_panic
343345
}
344-
346+
NullPointerDereference => middle_assert_null_ptr_deref,
345347
MisalignedPointerDereference { .. } => middle_assert_misaligned_ptr_deref,
346348
}
347349
}
@@ -374,7 +376,7 @@ impl<O> AssertKind<O> {
374376
add!("left", format!("{left:#?}"));
375377
add!("right", format!("{right:#?}"));
376378
}
377-
ResumedAfterReturn(_) | ResumedAfterPanic(_) => {}
379+
ResumedAfterReturn(_) | ResumedAfterPanic(_) | NullPointerDereference => {}
378380
MisalignedPointerDereference { required, found } => {
379381
add!("required", format!("{required:#?}"));
380382
add!("found", format!("{found:#?}"));

compiler/rustc_middle/src/mir/visit.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -636,7 +636,7 @@ macro_rules! make_mir_visitor {
636636
OverflowNeg(op) | DivisionByZero(op) | RemainderByZero(op) => {
637637
self.visit_operand(op, location);
638638
}
639-
ResumedAfterReturn(_) | ResumedAfterPanic(_) => {
639+
ResumedAfterReturn(_) | ResumedAfterPanic(_) | NullPointerDereference => {
640640
// Nothing to visit
641641
}
642642
MisalignedPointerDereference { required, found } => {
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
use rustc_index::IndexVec;
2+
use rustc_middle::mir::interpret::Scalar;
3+
use rustc_middle::mir::*;
4+
use rustc_middle::ty::{Ty, TyCtxt};
5+
use rustc_session::Session;
6+
7+
use crate::check_pointers::{BorrowCheckMode, PointerCheck, check_pointers};
8+
9+
pub(super) struct CheckNull;
10+
11+
impl<'tcx> crate::MirPass<'tcx> for CheckNull {
12+
fn is_enabled(&self, sess: &Session) -> bool {
13+
sess.ub_checks()
14+
}
15+
16+
fn run_pass(&self, tcx: TyCtxt<'tcx>, body: &mut Body<'tcx>) {
17+
check_pointers(tcx, body, &[], insert_null_check, BorrowCheckMode::IncludeBorrows);
18+
}
19+
20+
fn is_required(&self) -> bool {
21+
true
22+
}
23+
}
24+
25+
fn insert_null_check<'tcx>(
26+
tcx: TyCtxt<'tcx>,
27+
pointer: Place<'tcx>,
28+
pointee_ty: Ty<'tcx>,
29+
local_decls: &mut IndexVec<Local, LocalDecl<'tcx>>,
30+
stmts: &mut Vec<Statement<'tcx>>,
31+
source_info: SourceInfo,
32+
) -> PointerCheck<'tcx> {
33+
// Cast the pointer to a *const ().
34+
let const_raw_ptr = Ty::new_imm_ptr(tcx, tcx.types.unit);
35+
let rvalue = Rvalue::Cast(CastKind::PtrToPtr, Operand::Copy(pointer), const_raw_ptr);
36+
let thin_ptr = local_decls.push(LocalDecl::with_source_info(const_raw_ptr, source_info)).into();
37+
stmts
38+
.push(Statement { source_info, kind: StatementKind::Assign(Box::new((thin_ptr, rvalue))) });
39+
40+
// Transmute the pointer to a usize (equivalent to `ptr.addr()`).
41+
let rvalue = Rvalue::Cast(CastKind::Transmute, Operand::Copy(thin_ptr), tcx.types.usize);
42+
let addr = local_decls.push(LocalDecl::with_source_info(tcx.types.usize, source_info)).into();
43+
stmts.push(Statement { source_info, kind: StatementKind::Assign(Box::new((addr, rvalue))) });
44+
45+
// Get size of the pointee (zero-sized reads and writes are allowed).
46+
let rvalue = Rvalue::NullaryOp(NullOp::SizeOf, pointee_ty);
47+
let sizeof_pointee =
48+
local_decls.push(LocalDecl::with_source_info(tcx.types.usize, source_info)).into();
49+
stmts.push(Statement {
50+
source_info,
51+
kind: StatementKind::Assign(Box::new((sizeof_pointee, rvalue))),
52+
});
53+
54+
// Check that the pointee is not a ZST.
55+
let zero = Operand::Constant(Box::new(ConstOperand {
56+
span: source_info.span,
57+
user_ty: None,
58+
const_: Const::Val(ConstValue::Scalar(Scalar::from_target_usize(0, &tcx)), tcx.types.usize),
59+
}));
60+
let is_pointee_no_zst =
61+
local_decls.push(LocalDecl::with_source_info(tcx.types.bool, source_info)).into();
62+
stmts.push(Statement {
63+
source_info,
64+
kind: StatementKind::Assign(Box::new((
65+
is_pointee_no_zst,
66+
Rvalue::BinaryOp(BinOp::Ne, Box::new((Operand::Copy(sizeof_pointee), zero.clone()))),
67+
))),
68+
});
69+
70+
// Check whether the pointer is null.
71+
let is_null = local_decls.push(LocalDecl::with_source_info(tcx.types.bool, source_info)).into();
72+
stmts.push(Statement {
73+
source_info,
74+
kind: StatementKind::Assign(Box::new((
75+
is_null,
76+
Rvalue::BinaryOp(BinOp::Eq, Box::new((Operand::Copy(addr), zero))),
77+
))),
78+
});
79+
80+
// We want to throw an exception if the pointer is null and doesn't point to a ZST.
81+
let should_throw_exception =
82+
local_decls.push(LocalDecl::with_source_info(tcx.types.bool, source_info)).into();
83+
stmts.push(Statement {
84+
source_info,
85+
kind: StatementKind::Assign(Box::new((
86+
should_throw_exception,
87+
Rvalue::BinaryOp(
88+
BinOp::BitAnd,
89+
Box::new((Operand::Copy(is_null), Operand::Copy(is_pointee_no_zst))),
90+
),
91+
))),
92+
});
93+
94+
// The final condition whether this pointer usage is ok or not.
95+
let is_ok = local_decls.push(LocalDecl::with_source_info(tcx.types.bool, source_info)).into();
96+
stmts.push(Statement {
97+
source_info,
98+
kind: StatementKind::Assign(Box::new((
99+
is_ok,
100+
Rvalue::UnaryOp(UnOp::Not, Operand::Copy(should_throw_exception)),
101+
))),
102+
});
103+
104+
// Emit a PointerCheck that asserts on the condition and otherwise triggers
105+
// a AssertKind::NullPointerDereference.
106+
PointerCheck {
107+
cond: Operand::Copy(is_ok),
108+
assert_kind: Box::new(AssertKind::NullPointerDereference),
109+
}
110+
}

compiler/rustc_mir_transform/src/check_pointers.rs

+2-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ pub(crate) struct PointerCheck<'tcx> {
1717
/// [NonMutatingUseContext::SharedBorrow].
1818
#[derive(Copy, Clone)]
1919
pub(crate) enum BorrowCheckMode {
20+
IncludeBorrows,
2021
ExcludeBorrows,
2122
}
2223

@@ -168,7 +169,7 @@ impl<'a, 'tcx> PointerFinder<'a, 'tcx> {
168169
) => true,
169170
PlaceContext::MutatingUse(MutatingUseContext::Borrow)
170171
| PlaceContext::NonMutatingUse(NonMutatingUseContext::SharedBorrow) => {
171-
!matches!(self.borrow_check_mode, BorrowCheckMode::ExcludeBorrows)
172+
matches!(self.borrow_check_mode, BorrowCheckMode::IncludeBorrows)
172173
}
173174
_ => false,
174175
}

compiler/rustc_mir_transform/src/lib.rs

+2
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ declare_passes! {
119119
mod check_call_recursion : CheckCallRecursion, CheckDropRecursion;
120120
mod check_alignment : CheckAlignment;
121121
mod check_const_item_mutation : CheckConstItemMutation;
122+
mod check_null : CheckNull;
122123
mod check_packed_ref : CheckPackedRef;
123124
mod check_undefined_transmutes : CheckUndefinedTransmutes;
124125
// This pass is public to allow external drivers to perform MIR cleanup
@@ -643,6 +644,7 @@ fn run_optimization_passes<'tcx>(tcx: TyCtxt<'tcx>, body: &mut Body<'tcx>) {
643644
&[
644645
// Add some UB checks before any UB gets optimized away.
645646
&check_alignment::CheckAlignment,
647+
&check_null::CheckNull,
646648
// Before inlining: trim down MIR with passes to reduce inlining work.
647649

648650
// Has to be done before inlining, otherwise actual call will be almost always inlined.

compiler/rustc_monomorphize/src/collector.rs

+3
Original file line numberDiff line numberDiff line change
@@ -814,6 +814,9 @@ impl<'a, 'tcx> MirVisitor<'tcx> for MirUsedCollector<'a, 'tcx> {
814814
mir::AssertKind::MisalignedPointerDereference { .. } => {
815815
push_mono_lang_item(self, LangItem::PanicMisalignedPointerDereference);
816816
}
817+
mir::AssertKind::NullPointerDereference => {
818+
push_mono_lang_item(self, LangItem::PanicNullPointerDereference);
819+
}
817820
_ => {
818821
push_mono_lang_item(self, msg.panic_function());
819822
}

compiler/rustc_smir/src/rustc_smir/convert/mir.rs

+3
Original file line numberDiff line numberDiff line change
@@ -496,6 +496,9 @@ impl<'tcx> Stable<'tcx> for mir::AssertMessage<'tcx> {
496496
found: found.stable(tables),
497497
}
498498
}
499+
AssertKind::NullPointerDereference => {
500+
stable_mir::mir::AssertMessage::NullPointerDereference
501+
}
499502
}
500503
}
501504
}

compiler/rustc_span/src/symbol.rs

+1
Original file line numberDiff line numberDiff line change
@@ -1476,6 +1476,7 @@ symbols! {
14761476
panic_location,
14771477
panic_misaligned_pointer_dereference,
14781478
panic_nounwind,
1479+
panic_null_pointer_dereference,
14791480
panic_runtime,
14801481
panic_str_2015,
14811482
panic_unwind,

compiler/stable_mir/src/mir/body.rs

+2
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,7 @@ pub enum AssertMessage {
251251
ResumedAfterReturn(CoroutineKind),
252252
ResumedAfterPanic(CoroutineKind),
253253
MisalignedPointerDereference { required: Operand, found: Operand },
254+
NullPointerDereference,
254255
}
255256

256257
impl AssertMessage {
@@ -306,6 +307,7 @@ impl AssertMessage {
306307
AssertMessage::MisalignedPointerDereference { .. } => {
307308
Ok("misaligned pointer dereference")
308309
}
310+
AssertMessage::NullPointerDereference => Ok("null pointer dereference occured"),
309311
}
310312
}
311313
}

compiler/stable_mir/src/mir/pretty.rs

+3
Original file line numberDiff line numberDiff line change
@@ -298,6 +298,9 @@ fn pretty_assert_message<W: Write>(writer: &mut W, msg: &AssertMessage) -> io::R
298298
"\"misaligned pointer dereference: address must be a multiple of {{}} but is {{}}\",{pretty_required}, {pretty_found}"
299299
)
300300
}
301+
AssertMessage::NullPointerDereference => {
302+
write!(writer, "\"null pointer dereference occured.\"")
303+
}
301304
AssertMessage::ResumedAfterReturn(_) | AssertMessage::ResumedAfterPanic(_) => {
302305
write!(writer, "{}", msg.description().unwrap())
303306
}

compiler/stable_mir/src/mir/visit.rs

+4-1
Original file line numberDiff line numberDiff line change
@@ -426,7 +426,10 @@ pub trait MirVisitor {
426426
| AssertMessage::RemainderByZero(op) => {
427427
self.visit_operand(op, location);
428428
}
429-
AssertMessage::ResumedAfterReturn(_) | AssertMessage::ResumedAfterPanic(_) => { //nothing to visit
429+
AssertMessage::ResumedAfterReturn(_)
430+
| AssertMessage::ResumedAfterPanic(_)
431+
| AssertMessage::NullPointerDereference => {
432+
//nothing to visit
430433
}
431434
AssertMessage::MisalignedPointerDereference { required, found } => {
432435
self.visit_operand(required, location);

library/core/src/panicking.rs

+16
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,22 @@ fn panic_misaligned_pointer_dereference(required: usize, found: usize) -> ! {
291291
)
292292
}
293293

294+
#[cfg_attr(not(feature = "panic_immediate_abort"), inline(never), cold, optimize(size))]
295+
#[cfg_attr(feature = "panic_immediate_abort", inline)]
296+
#[track_caller]
297+
#[cfg_attr(not(bootstrap), lang = "panic_null_pointer_dereference")] // needed by codegen for panic on null pointer deref
298+
#[rustc_nounwind] // `CheckNull` MIR pass requires this function to never unwind
299+
fn panic_null_pointer_dereference() -> ! {
300+
if cfg!(feature = "panic_immediate_abort") {
301+
super::intrinsics::abort()
302+
}
303+
304+
panic_nounwind_fmt(
305+
format_args!("null pointer dereference occured"),
306+
/* force_no_backtrace */ false,
307+
)
308+
}
309+
294310
/// Panics because we cannot unwind out of a function.
295311
///
296312
/// This is a separate function to avoid the codesize impact of each crate containing the string to

src/tools/clippy/src/driver.rs

+2
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,8 @@ impl rustc_driver::Callbacks for ClippyCallbacks {
166166
// MIR passes can be enabled / disabled separately, we should figure out, what passes to
167167
// use for Clippy.
168168
config.opts.unstable_opts.mir_opt_level = Some(0);
169+
config.opts.unstable_opts.mir_enable_passes =
170+
vec![("CheckNull".to_owned(), false), ("CheckAlignment".to_owned(), false)];
169171

170172
// Disable flattening and inlining of format_args!(), so the HIR matches with the AST.
171173
config.opts.unstable_opts.flatten_format_args = false;

src/tools/miri/src/lib.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ pub const MIRI_DEFAULT_ARGS: &[&str] = &[
168168
"-Zmir-emit-retag",
169169
"-Zmir-keep-place-mention",
170170
"-Zmir-opt-level=0",
171-
"-Zmir-enable-passes=-CheckAlignment",
171+
"-Zmir-enable-passes=-CheckAlignment,-CheckNull",
172172
// Deduplicating diagnostics means we miss events when tracking what happens during an
173173
// execution. Let's not do that.
174174
"-Zdeduplicate-diagnostics=no",

src/tools/rust-analyzer/crates/hir-def/src/lang_item.rs

+1
Original file line numberDiff line numberDiff line change
@@ -411,6 +411,7 @@ language_item_table! {
411411
PanicLocation, sym::panic_location, panic_location, Target::Struct, GenericRequirement::None;
412412
PanicImpl, sym::panic_impl, panic_impl, Target::Fn, GenericRequirement::None;
413413
PanicCannotUnwind, sym::panic_cannot_unwind, panic_cannot_unwind, Target::Fn, GenericRequirement::Exact(0);
414+
PanicNullPointerDereference, sym::panic_null_pointer_dereference, panic_null_pointer_dereference, Target::Fn, GenericRequirement::None;
414415
/// libstd panic entry point. Necessary for const eval to be able to catch it
415416
BeginPanic, sym::begin_panic, begin_panic_fn, Target::Fn, GenericRequirement::None;
416417

src/tools/rust-analyzer/crates/intern/src/symbol/symbols.rs

+1
Original file line numberDiff line numberDiff line change
@@ -363,6 +363,7 @@ define_symbols! {
363363
panic_location,
364364
panic_misaligned_pointer_dereference,
365365
panic_nounwind,
366+
panic_null_pointer_dereference,
366367
panic,
367368
Param,
368369
parse,
+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
//@ compile-flags: -C debug-assertions
2+
3+
struct Null {
4+
a: u32,
5+
}
6+
7+
fn main() {
8+
// CHECK-LABEL: fn main(
9+
// CHECK-NOT: {{assert.*}}
10+
let val: u32 = 42;
11+
let val_ref: &u32 = &val;
12+
let _access1: &u32 = &*val_ref;
13+
14+
let val = Null { a: 42 };
15+
let _access2: &u32 = &val.a;
16+
}

tests/ui/abi/segfault-no-out-of-stack.rs

+1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
//@ run-pass
22
//@ needs-subprocess
3+
//@ compile-flags: -Zub-checks=no -Zmir-enable-passes=-CheckNull
34
//@ ignore-fuchsia must translate zircon signal to SIGSEGV/SIGBUS, FIXME (#58590)
45

56
#![feature(rustc_private)]

0 commit comments

Comments
 (0)