rustc_const_eval/interpret/validity.rs
1//! Check the validity invariant of a given value, and tell the user
2//! where in the value it got violated.
3//! In const context, this goes even further and tries to approximate const safety.
4//! That's useful because it means other passes (e.g. promotion) can rely on `const`s
5//! to be const-safe.
6
7use std::borrow::Cow;
8use std::fmt::Write;
9use std::hash::Hash;
10use std::num::NonZero;
11
12use either::{Left, Right};
13use hir::def::DefKind;
14use rustc_abi::{
15 BackendRepr, FieldIdx, FieldsShape, Scalar as ScalarAbi, Size, VariantIdx, Variants,
16 WrappingRange,
17};
18use rustc_ast::Mutability;
19use rustc_data_structures::fx::FxHashSet;
20use rustc_hir as hir;
21use rustc_middle::bug;
22use rustc_middle::mir::interpret::ValidationErrorKind::{self, *};
23use rustc_middle::mir::interpret::{
24 ExpectedKind, InterpErrorKind, InvalidMetaKind, Misalignment, PointerKind, Provenance,
25 UnsupportedOpInfo, ValidationErrorInfo, alloc_range, interp_ok,
26};
27use rustc_middle::ty::layout::{LayoutCx, TyAndLayout};
28use rustc_middle::ty::{self, Ty};
29use rustc_span::{Symbol, sym};
30use tracing::trace;
31
32use super::machine::AllocMap;
33use super::{
34 AllocId, CheckInAllocMsg, GlobalAlloc, ImmTy, Immediate, InterpCx, InterpResult, MPlaceTy,
35 Machine, MemPlaceMeta, PlaceTy, Pointer, Projectable, Scalar, ValueVisitor, err_ub,
36 format_interp_error,
37};
38use crate::enter_trace_span;
39
40// for the validation errors
41#[rustfmt::skip]
42use super::InterpErrorKind::UndefinedBehavior as Ub;
43use super::InterpErrorKind::Unsupported as Unsup;
44use super::UndefinedBehaviorInfo::*;
45use super::UnsupportedOpInfo::*;
46
47macro_rules! err_validation_failure {
48 ($where:expr, $kind: expr) => {{
49 let where_ = &$where;
50 let path = if !where_.is_empty() {
51 let mut path = String::new();
52 write_path(&mut path, where_);
53 Some(path)
54 } else {
55 None
56 };
57
58 err_ub!(ValidationError(ValidationErrorInfo { path, kind: $kind }))
59 }};
60}
61
62macro_rules! throw_validation_failure {
63 ($where:expr, $kind: expr) => {
64 do yeet err_validation_failure!($where, $kind)
65 };
66}
67
68/// If $e throws an error matching the pattern, throw a validation failure.
69/// Other errors are passed back to the caller, unchanged -- and if they reach the root of
70/// the visitor, we make sure only validation errors and `InvalidProgram` errors are left.
71/// This lets you use the patterns as a kind of validation list, asserting which errors
72/// can possibly happen:
73///
74/// ```ignore(illustrative)
75/// let v = try_validation!(some_fn(), some_path, {
76/// Foo | Bar | Baz => { "some failure" },
77/// });
78/// ```
79///
80/// The patterns must be of type `UndefinedBehaviorInfo`.
81/// An additional expected parameter can also be added to the failure message:
82///
83/// ```ignore(illustrative)
84/// let v = try_validation!(some_fn(), some_path, {
85/// Foo | Bar | Baz => { "some failure" } expected { "something that wasn't a failure" },
86/// });
87/// ```
88///
89/// An additional nicety is that both parameters actually take format args, so you can just write
90/// the format string in directly:
91///
92/// ```ignore(illustrative)
93/// let v = try_validation!(some_fn(), some_path, {
94/// Foo | Bar | Baz => { "{:?}", some_failure } expected { "{}", expected_value },
95/// });
96/// ```
97///
98macro_rules! try_validation {
99 ($e:expr, $where:expr,
100 $( $( $p:pat_param )|+ => $kind: expr ),+ $(,)?
101 ) => {{
102 $e.map_err_kind(|e| {
103 // We catch the error and turn it into a validation failure. We are okay with
104 // allocation here as this can only slow down builds that fail anyway.
105 match e {
106 $(
107 $($p)|+ => {
108 err_validation_failure!(
109 $where,
110 $kind
111 )
112 }
113 ),+,
114 e => e,
115 }
116 })?
117 }};
118}
119
120/// We want to show a nice path to the invalid field for diagnostics,
121/// but avoid string operations in the happy case where no error happens.
122/// So we track a `Vec<PathElem>` where `PathElem` contains all the data we
123/// need to later print something for the user.
124#[derive(Copy, Clone, Debug)]
125pub enum PathElem {
126 Field(Symbol),
127 Variant(Symbol),
128 CoroutineState(VariantIdx),
129 CapturedVar(Symbol),
130 ArrayElem(usize),
131 TupleElem(usize),
132 Deref,
133 EnumTag,
134 CoroutineTag,
135 DynDowncast,
136 Vtable,
137}
138
139/// Extra things to check for during validation of CTFE results.
140#[derive(Copy, Clone)]
141pub enum CtfeValidationMode {
142 /// Validation of a `static`
143 Static { mutbl: Mutability },
144 /// Validation of a promoted.
145 Promoted,
146 /// Validation of a `const`.
147 /// `allow_immutable_unsafe_cell` says whether we allow `UnsafeCell` in immutable memory (which is the
148 /// case for the top-level allocation of a `const`, where this is fine because the allocation will be
149 /// copied at each use site).
150 Const { allow_immutable_unsafe_cell: bool },
151}
152
153impl CtfeValidationMode {
154 fn allow_immutable_unsafe_cell(self) -> bool {
155 match self {
156 CtfeValidationMode::Static { .. } => false,
157 CtfeValidationMode::Promoted { .. } => false,
158 CtfeValidationMode::Const { allow_immutable_unsafe_cell, .. } => {
159 allow_immutable_unsafe_cell
160 }
161 }
162 }
163}
164
165/// State for tracking recursive validation of references
166pub struct RefTracking<T, PATH = ()> {
167 seen: FxHashSet<T>,
168 todo: Vec<(T, PATH)>,
169}
170
171impl<T: Clone + Eq + Hash + std::fmt::Debug, PATH: Default> RefTracking<T, PATH> {
172 pub fn empty() -> Self {
173 RefTracking { seen: FxHashSet::default(), todo: vec![] }
174 }
175 pub fn new(val: T) -> Self {
176 let mut ref_tracking_for_consts =
177 RefTracking { seen: FxHashSet::default(), todo: vec![(val.clone(), PATH::default())] };
178 ref_tracking_for_consts.seen.insert(val);
179 ref_tracking_for_consts
180 }
181 pub fn next(&mut self) -> Option<(T, PATH)> {
182 self.todo.pop()
183 }
184
185 fn track(&mut self, val: T, path: impl FnOnce() -> PATH) {
186 if self.seen.insert(val.clone()) {
187 trace!("Recursing below ptr {:#?}", val);
188 let path = path();
189 // Remember to come back to this later.
190 self.todo.push((val, path));
191 }
192 }
193}
194
195// FIXME make this translatable as well?
196/// Format a path
197fn write_path(out: &mut String, path: &[PathElem]) {
198 use self::PathElem::*;
199
200 for elem in path.iter() {
201 match elem {
202 Field(name) => write!(out, ".{name}"),
203 EnumTag => write!(out, ".<enum-tag>"),
204 Variant(name) => write!(out, ".<enum-variant({name})>"),
205 CoroutineTag => write!(out, ".<coroutine-tag>"),
206 CoroutineState(idx) => write!(out, ".<coroutine-state({})>", idx.index()),
207 CapturedVar(name) => write!(out, ".<captured-var({name})>"),
208 TupleElem(idx) => write!(out, ".{idx}"),
209 ArrayElem(idx) => write!(out, "[{idx}]"),
210 // `.<deref>` does not match Rust syntax, but it is more readable for long paths -- and
211 // some of the other items here also are not Rust syntax. Actually we can't
212 // even use the usual syntax because we are just showing the projections,
213 // not the root.
214 Deref => write!(out, ".<deref>"),
215 DynDowncast => write!(out, ".<dyn-downcast>"),
216 Vtable => write!(out, ".<vtable>"),
217 }
218 .unwrap()
219 }
220}
221
222/// Represents a set of `Size` values as a sorted list of ranges.
223// These are (offset, length) pairs, and they are sorted and mutually disjoint,
224// and never adjacent (i.e. there's always a gap between two of them).
225#[derive(Debug, Clone)]
226pub struct RangeSet(Vec<(Size, Size)>);
227
228impl RangeSet {
229 fn add_range(&mut self, offset: Size, size: Size) {
230 if size.bytes() == 0 {
231 // No need to track empty ranges.
232 return;
233 }
234 let v = &mut self.0;
235 // We scan for a partition point where the left partition is all the elements that end
236 // strictly before we start. Those are elements that are too "low" to merge with us.
237 let idx =
238 v.partition_point(|&(other_offset, other_size)| other_offset + other_size < offset);
239 // Now we want to either merge with the first element of the second partition, or insert ourselves before that.
240 if let Some(&(other_offset, other_size)) = v.get(idx)
241 && offset + size >= other_offset
242 {
243 // Their end is >= our start (otherwise it would not be in the 2nd partition) and
244 // our end is >= their start. This means we can merge the ranges.
245 let new_start = other_offset.min(offset);
246 let mut new_end = (other_offset + other_size).max(offset + size);
247 // We grew to the right, so merge with overlapping/adjacent elements.
248 // (We also may have grown to the left, but that can never make us adjacent with
249 // anything there since we selected the first such candidate via `partition_point`.)
250 let mut scan_right = 1;
251 while let Some(&(next_offset, next_size)) = v.get(idx + scan_right)
252 && new_end >= next_offset
253 {
254 // Increase our size to absorb the next element.
255 new_end = new_end.max(next_offset + next_size);
256 // Look at the next element.
257 scan_right += 1;
258 }
259 // Update the element we grew.
260 v[idx] = (new_start, new_end - new_start);
261 // Remove the elements we absorbed (if any).
262 if scan_right > 1 {
263 drop(v.drain((idx + 1)..(idx + scan_right)));
264 }
265 } else {
266 // Insert new element.
267 v.insert(idx, (offset, size));
268 }
269 }
270}
271
272struct ValidityVisitor<'rt, 'tcx, M: Machine<'tcx>> {
273 /// The `path` may be pushed to, but the part that is present when a function
274 /// starts must not be changed! `visit_fields` and `visit_array` rely on
275 /// this stack discipline.
276 path: Vec<PathElem>,
277 ref_tracking: Option<&'rt mut RefTracking<MPlaceTy<'tcx, M::Provenance>, Vec<PathElem>>>,
278 /// `None` indicates this is not validating for CTFE (but for runtime).
279 ctfe_mode: Option<CtfeValidationMode>,
280 ecx: &'rt mut InterpCx<'tcx, M>,
281 /// Whether provenance should be reset outside of pointers (emulating the effect of a typed
282 /// copy).
283 reset_provenance_and_padding: bool,
284 /// This tracks which byte ranges in this value contain data; the remaining bytes are padding.
285 /// The ideal representation here would be pointer-length pairs, but to keep things more compact
286 /// we only store a (range) set of offsets -- the base pointer is the same throughout the entire
287 /// visit, after all.
288 /// If this is `Some`, then `reset_provenance_and_padding` must be true (but not vice versa:
289 /// we might not track data vs padding bytes if the operand isn't stored in memory anyway).
290 data_bytes: Option<RangeSet>,
291}
292
293impl<'rt, 'tcx, M: Machine<'tcx>> ValidityVisitor<'rt, 'tcx, M> {
294 fn aggregate_field_path_elem(&mut self, layout: TyAndLayout<'tcx>, field: usize) -> PathElem {
295 // First, check if we are projecting to a variant.
296 match layout.variants {
297 Variants::Multiple { tag_field, .. } => {
298 if tag_field.as_usize() == field {
299 return match layout.ty.kind() {
300 ty::Adt(def, ..) if def.is_enum() => PathElem::EnumTag,
301 ty::Coroutine(..) => PathElem::CoroutineTag,
302 _ => bug!("non-variant type {:?}", layout.ty),
303 };
304 }
305 }
306 Variants::Single { .. } | Variants::Empty => {}
307 }
308
309 // Now we know we are projecting to a field, so figure out which one.
310 match layout.ty.kind() {
311 // coroutines, closures, and coroutine-closures all have upvars that may be named.
312 ty::Closure(def_id, _) | ty::Coroutine(def_id, _) | ty::CoroutineClosure(def_id, _) => {
313 let mut name = None;
314 // FIXME this should be more descriptive i.e. CapturePlace instead of CapturedVar
315 // https://github.com/rust-lang/project-rfc-2229/issues/46
316 if let Some(local_def_id) = def_id.as_local() {
317 let captures = self.ecx.tcx.closure_captures(local_def_id);
318 if let Some(captured_place) = captures.get(field) {
319 // Sometimes the index is beyond the number of upvars (seen
320 // for a coroutine).
321 let var_hir_id = captured_place.get_root_variable();
322 let node = self.ecx.tcx.hir_node(var_hir_id);
323 if let hir::Node::Pat(pat) = node {
324 if let hir::PatKind::Binding(_, _, ident, _) = pat.kind {
325 name = Some(ident.name);
326 }
327 }
328 }
329 }
330
331 PathElem::CapturedVar(name.unwrap_or_else(|| {
332 // Fall back to showing the field index.
333 sym::integer(field)
334 }))
335 }
336
337 // tuples
338 ty::Tuple(_) => PathElem::TupleElem(field),
339
340 // enums
341 ty::Adt(def, ..) if def.is_enum() => {
342 // we might be projecting *to* a variant, or to a field *in* a variant.
343 match layout.variants {
344 Variants::Single { index } => {
345 // Inside a variant
346 PathElem::Field(def.variant(index).fields[FieldIdx::from_usize(field)].name)
347 }
348 Variants::Empty => panic!("there is no field in Variants::Empty types"),
349 Variants::Multiple { .. } => bug!("we handled variants above"),
350 }
351 }
352
353 // other ADTs
354 ty::Adt(def, _) => {
355 PathElem::Field(def.non_enum_variant().fields[FieldIdx::from_usize(field)].name)
356 }
357
358 // arrays/slices
359 ty::Array(..) | ty::Slice(..) => PathElem::ArrayElem(field),
360
361 // dyn* vtables
362 ty::Dynamic(_, _, ty::DynKind::DynStar) if field == 1 => PathElem::Vtable,
363
364 // dyn traits
365 ty::Dynamic(..) => {
366 assert_eq!(field, 0);
367 PathElem::DynDowncast
368 }
369
370 // nothing else has an aggregate layout
371 _ => bug!("aggregate_field_path_elem: got non-aggregate type {:?}", layout.ty),
372 }
373 }
374
375 fn with_elem<R>(
376 &mut self,
377 elem: PathElem,
378 f: impl FnOnce(&mut Self) -> InterpResult<'tcx, R>,
379 ) -> InterpResult<'tcx, R> {
380 // Remember the old state
381 let path_len = self.path.len();
382 // Record new element
383 self.path.push(elem);
384 // Perform operation
385 let r = f(self)?;
386 // Undo changes
387 self.path.truncate(path_len);
388 // Done
389 interp_ok(r)
390 }
391
392 fn read_immediate(
393 &self,
394 val: &PlaceTy<'tcx, M::Provenance>,
395 expected: ExpectedKind,
396 ) -> InterpResult<'tcx, ImmTy<'tcx, M::Provenance>> {
397 interp_ok(try_validation!(
398 self.ecx.read_immediate(val),
399 self.path,
400 Ub(InvalidUninitBytes(None)) =>
401 Uninit { expected },
402 // The `Unsup` cases can only occur during CTFE
403 Unsup(ReadPointerAsInt(_)) =>
404 PointerAsInt { expected },
405 Unsup(ReadPartialPointer(_)) =>
406 PartialPointer,
407 ))
408 }
409
410 fn read_scalar(
411 &self,
412 val: &PlaceTy<'tcx, M::Provenance>,
413 expected: ExpectedKind,
414 ) -> InterpResult<'tcx, Scalar<M::Provenance>> {
415 interp_ok(self.read_immediate(val, expected)?.to_scalar())
416 }
417
418 fn deref_pointer(
419 &mut self,
420 val: &PlaceTy<'tcx, M::Provenance>,
421 expected: ExpectedKind,
422 ) -> InterpResult<'tcx, MPlaceTy<'tcx, M::Provenance>> {
423 // Not using `ecx.deref_pointer` since we want to use our `read_immediate` wrapper.
424 let imm = self.read_immediate(val, expected)?;
425 // Reset provenance: ensure slice tail metadata does not preserve provenance,
426 // and ensure all pointers do not preserve partial provenance.
427 if self.reset_provenance_and_padding {
428 if matches!(imm.layout.backend_repr, BackendRepr::Scalar(..)) {
429 // A thin pointer. If it has provenance, we don't have to do anything.
430 // If it does not, ensure we clear the provenance in memory.
431 if matches!(imm.to_scalar(), Scalar::Int(..)) {
432 self.ecx.clear_provenance(val)?;
433 }
434 } else {
435 // A wide pointer. This means we have to worry both about the pointer itself and the
436 // metadata. We do the lazy thing and just write back the value we got. Just
437 // clearing provenance in a targeted manner would be more efficient, but unless this
438 // is a perf hotspot it's just not worth the effort.
439 self.ecx.write_immediate_no_validate(*imm, val)?;
440 }
441 // The entire thing is data, not padding.
442 self.add_data_range_place(val);
443 }
444 // Now turn it into a place.
445 self.ecx.ref_to_mplace(&imm)
446 }
447
448 fn check_wide_ptr_meta(
449 &mut self,
450 meta: MemPlaceMeta<M::Provenance>,
451 pointee: TyAndLayout<'tcx>,
452 ) -> InterpResult<'tcx> {
453 let tail = self.ecx.tcx.struct_tail_for_codegen(pointee.ty, self.ecx.typing_env);
454 match tail.kind() {
455 ty::Dynamic(data, _, ty::Dyn) => {
456 let vtable = meta.unwrap_meta().to_pointer(self.ecx)?;
457 // Make sure it is a genuine vtable pointer for the right trait.
458 try_validation!(
459 self.ecx.get_ptr_vtable_ty(vtable, Some(data)),
460 self.path,
461 Ub(DanglingIntPointer{ .. } | InvalidVTablePointer(..)) =>
462 InvalidVTablePtr { value: format!("{vtable}") },
463 Ub(InvalidVTableTrait { vtable_dyn_type, expected_dyn_type }) => {
464 InvalidMetaWrongTrait { vtable_dyn_type, expected_dyn_type }
465 },
466 );
467 }
468 ty::Slice(..) | ty::Str => {
469 let _len = meta.unwrap_meta().to_target_usize(self.ecx)?;
470 // We do not check that `len * elem_size <= isize::MAX`:
471 // that is only required for references, and there it falls out of the
472 // "dereferenceable" check performed by Stacked Borrows.
473 }
474 ty::Foreign(..) => {
475 // Unsized, but not wide.
476 }
477 _ => bug!("Unexpected unsized type tail: {:?}", tail),
478 }
479
480 interp_ok(())
481 }
482
483 /// Check a reference or `Box`.
484 fn check_safe_pointer(
485 &mut self,
486 value: &PlaceTy<'tcx, M::Provenance>,
487 ptr_kind: PointerKind,
488 ) -> InterpResult<'tcx> {
489 let place = self.deref_pointer(value, ptr_kind.into())?;
490 // Handle wide pointers.
491 // Check metadata early, for better diagnostics
492 if place.layout.is_unsized() {
493 self.check_wide_ptr_meta(place.meta(), place.layout)?;
494 }
495 // Make sure this is dereferenceable and all.
496 let size_and_align = try_validation!(
497 self.ecx.size_and_align_of_val(&place),
498 self.path,
499 Ub(InvalidMeta(msg)) => match msg {
500 InvalidMetaKind::SliceTooBig => InvalidMetaSliceTooLarge { ptr_kind },
501 InvalidMetaKind::TooBig => InvalidMetaTooLarge { ptr_kind },
502 }
503 );
504 let (size, align) = size_and_align
505 // for the purpose of validity, consider foreign types to have
506 // alignment and size determined by the layout (size will be 0,
507 // alignment should take attributes into account).
508 .unwrap_or_else(|| (place.layout.size, place.layout.align.abi));
509 // Direct call to `check_ptr_access_align` checks alignment even on CTFE machines.
510 try_validation!(
511 self.ecx.check_ptr_access(
512 place.ptr(),
513 size,
514 CheckInAllocMsg::Dereferenceable, // will anyway be replaced by validity message
515 ),
516 self.path,
517 Ub(DanglingIntPointer { addr: 0, .. }) => NullPtr { ptr_kind },
518 Ub(DanglingIntPointer { addr: i, .. }) => DanglingPtrNoProvenance {
519 ptr_kind,
520 // FIXME this says "null pointer" when null but we need translate
521 pointer: format!("{}", Pointer::<Option<AllocId>>::from_addr_invalid(i))
522 },
523 Ub(PointerOutOfBounds { .. }) => DanglingPtrOutOfBounds {
524 ptr_kind
525 },
526 Ub(PointerUseAfterFree(..)) => DanglingPtrUseAfterFree {
527 ptr_kind,
528 },
529 );
530 try_validation!(
531 self.ecx.check_ptr_align(
532 place.ptr(),
533 align,
534 ),
535 self.path,
536 Ub(AlignmentCheckFailed(Misalignment { required, has }, _msg)) => UnalignedPtr {
537 ptr_kind,
538 required_bytes: required.bytes(),
539 found_bytes: has.bytes()
540 },
541 );
542 // Make sure this is non-null. We checked dereferenceability above, but if `size` is zero
543 // that does not imply non-null.
544 if self.ecx.scalar_may_be_null(Scalar::from_maybe_pointer(place.ptr(), self.ecx))? {
545 throw_validation_failure!(self.path, NullPtr { ptr_kind })
546 }
547 // Do not allow references to uninhabited types.
548 if place.layout.is_uninhabited() {
549 let ty = place.layout.ty;
550 throw_validation_failure!(self.path, PtrToUninhabited { ptr_kind, ty })
551 }
552 // Recursive checking
553 if let Some(ref_tracking) = self.ref_tracking.as_deref_mut() {
554 // Proceed recursively even for ZST, no reason to skip them!
555 // `!` is a ZST and we want to validate it.
556 if let Some(ctfe_mode) = self.ctfe_mode {
557 let mut skip_recursive_check = false;
558 // CTFE imposes restrictions on what references can point to.
559 if let Ok((alloc_id, _offset, _prov)) =
560 self.ecx.ptr_try_get_alloc_id(place.ptr(), 0)
561 {
562 // Everything should be already interned.
563 let Some(global_alloc) = self.ecx.tcx.try_get_global_alloc(alloc_id) else {
564 assert!(self.ecx.memory.alloc_map.get(alloc_id).is_none());
565 // We can't have *any* references to non-existing allocations in const-eval
566 // as the rest of rustc isn't happy with them... so we throw an error, even
567 // though for zero-sized references this isn't really UB.
568 // A potential future alternative would be to resurrect this as a zero-sized allocation
569 // (which codegen will then compile to an aligned dummy pointer anyway).
570 throw_validation_failure!(self.path, DanglingPtrUseAfterFree { ptr_kind });
571 };
572 let (size, _align) =
573 global_alloc.size_and_align(*self.ecx.tcx, self.ecx.typing_env);
574 let alloc_actual_mutbl =
575 global_alloc.mutability(*self.ecx.tcx, self.ecx.typing_env);
576
577 if let GlobalAlloc::Static(did) = global_alloc {
578 let DefKind::Static { nested, .. } = self.ecx.tcx.def_kind(did) else {
579 bug!()
580 };
581 // Special handling for pointers to statics (irrespective of their type).
582 assert!(!self.ecx.tcx.is_thread_local_static(did));
583 assert!(self.ecx.tcx.is_static(did));
584 // Mode-specific checks
585 match ctfe_mode {
586 CtfeValidationMode::Static { .. }
587 | CtfeValidationMode::Promoted { .. } => {
588 // We skip recursively checking other statics. These statics must be sound by
589 // themselves, and the only way to get broken statics here is by using
590 // unsafe code.
591 // The reasons we don't check other statics is twofold. For one, in all
592 // sound cases, the static was already validated on its own, and second, we
593 // trigger cycle errors if we try to compute the value of the other static
594 // and that static refers back to us (potentially through a promoted).
595 // This could miss some UB, but that's fine.
596 // We still walk nested allocations, as they are fundamentally part of this validation run.
597 // This means we will also recurse into nested statics of *other*
598 // statics, even though we do not recurse into other statics directly.
599 // That's somewhat inconsistent but harmless.
600 skip_recursive_check = !nested;
601 }
602 CtfeValidationMode::Const { .. } => {
603 // If this is mutable memory or an `extern static`, there's no point in checking it -- we'd
604 // just get errors trying to read the value.
605 if alloc_actual_mutbl.is_mut() || self.ecx.tcx.is_foreign_item(did)
606 {
607 skip_recursive_check = true;
608 }
609 }
610 }
611 }
612
613 // If this allocation has size zero, there is no actual mutability here.
614 if size != Size::ZERO {
615 // Determine whether this pointer expects to be pointing to something mutable.
616 let ptr_expected_mutbl = match ptr_kind {
617 PointerKind::Box => Mutability::Mut,
618 PointerKind::Ref(mutbl) => {
619 // We do not take into account interior mutability here since we cannot know if
620 // there really is an `UnsafeCell` inside `Option<UnsafeCell>` -- so we check
621 // that in the recursive descent behind this reference (controlled by
622 // `allow_immutable_unsafe_cell`).
623 mutbl
624 }
625 };
626 // Mutable pointer to immutable memory is no good.
627 if ptr_expected_mutbl == Mutability::Mut
628 && alloc_actual_mutbl == Mutability::Not
629 {
630 // This can actually occur with transmutes.
631 throw_validation_failure!(self.path, MutableRefToImmutable);
632 }
633 // In a const, any kind of mutable reference is not good.
634 if matches!(self.ctfe_mode, Some(CtfeValidationMode::Const { .. })) {
635 if ptr_expected_mutbl == Mutability::Mut {
636 throw_validation_failure!(self.path, MutableRefInConst);
637 }
638 }
639 }
640 }
641 // Potentially skip recursive check.
642 if skip_recursive_check {
643 return interp_ok(());
644 }
645 } else {
646 // This is not CTFE, so it's Miri with recursive checking.
647 // FIXME: we do *not* check behind boxes, since creating a new box first creates it uninitialized
648 // and then puts the value in there, so briefly we have a box with uninit contents.
649 // FIXME: should we also skip `UnsafeCell` behind shared references? Currently that is not
650 // needed since validation reads bypass Stacked Borrows and data race checks.
651 if matches!(ptr_kind, PointerKind::Box) {
652 return interp_ok(());
653 }
654 }
655 let path = &self.path;
656 ref_tracking.track(place, || {
657 // We need to clone the path anyway, make sure it gets created
658 // with enough space for the additional `Deref`.
659 let mut new_path = Vec::with_capacity(path.len() + 1);
660 new_path.extend(path);
661 new_path.push(PathElem::Deref);
662 new_path
663 });
664 }
665 interp_ok(())
666 }
667
668 /// Check if this is a value of primitive type, and if yes check the validity of the value
669 /// at that type. Return `true` if the type is indeed primitive.
670 ///
671 /// Note that not all of these have `FieldsShape::Primitive`, e.g. wide references.
672 fn try_visit_primitive(
673 &mut self,
674 value: &PlaceTy<'tcx, M::Provenance>,
675 ) -> InterpResult<'tcx, bool> {
676 // Go over all the primitive types
677 let ty = value.layout.ty;
678 match ty.kind() {
679 ty::Bool => {
680 let scalar = self.read_scalar(value, ExpectedKind::Bool)?;
681 try_validation!(
682 scalar.to_bool(),
683 self.path,
684 Ub(InvalidBool(..)) => ValidationErrorKind::InvalidBool {
685 value: format!("{scalar:x}"),
686 }
687 );
688 if self.reset_provenance_and_padding {
689 self.ecx.clear_provenance(value)?;
690 self.add_data_range_place(value);
691 }
692 interp_ok(true)
693 }
694 ty::Char => {
695 let scalar = self.read_scalar(value, ExpectedKind::Char)?;
696 try_validation!(
697 scalar.to_char(),
698 self.path,
699 Ub(InvalidChar(..)) => ValidationErrorKind::InvalidChar {
700 value: format!("{scalar:x}"),
701 }
702 );
703 if self.reset_provenance_and_padding {
704 self.ecx.clear_provenance(value)?;
705 self.add_data_range_place(value);
706 }
707 interp_ok(true)
708 }
709 ty::Float(_) | ty::Int(_) | ty::Uint(_) => {
710 // NOTE: Keep this in sync with the array optimization for int/float
711 // types below!
712 self.read_scalar(
713 value,
714 if matches!(ty.kind(), ty::Float(..)) {
715 ExpectedKind::Float
716 } else {
717 ExpectedKind::Int
718 },
719 )?;
720 if self.reset_provenance_and_padding {
721 self.ecx.clear_provenance(value)?;
722 self.add_data_range_place(value);
723 }
724 interp_ok(true)
725 }
726 ty::RawPtr(..) => {
727 let place = self.deref_pointer(value, ExpectedKind::RawPtr)?;
728 if place.layout.is_unsized() {
729 self.check_wide_ptr_meta(place.meta(), place.layout)?;
730 }
731 interp_ok(true)
732 }
733 ty::Ref(_, _ty, mutbl) => {
734 self.check_safe_pointer(value, PointerKind::Ref(*mutbl))?;
735 interp_ok(true)
736 }
737 ty::FnPtr(..) => {
738 let scalar = self.read_scalar(value, ExpectedKind::FnPtr)?;
739
740 // If we check references recursively, also check that this points to a function.
741 if let Some(_) = self.ref_tracking {
742 let ptr = scalar.to_pointer(self.ecx)?;
743 let _fn = try_validation!(
744 self.ecx.get_ptr_fn(ptr),
745 self.path,
746 Ub(DanglingIntPointer{ .. } | InvalidFunctionPointer(..)) =>
747 InvalidFnPtr { value: format!("{ptr}") },
748 );
749 // FIXME: Check if the signature matches
750 } else {
751 // Otherwise (for standalone Miri), we have to still check it to be non-null.
752 if self.ecx.scalar_may_be_null(scalar)? {
753 throw_validation_failure!(self.path, NullFnPtr);
754 }
755 }
756 if self.reset_provenance_and_padding {
757 // Make sure we do not preserve partial provenance. This matches the thin
758 // pointer handling in `deref_pointer`.
759 if matches!(scalar, Scalar::Int(..)) {
760 self.ecx.clear_provenance(value)?;
761 }
762 self.add_data_range_place(value);
763 }
764 interp_ok(true)
765 }
766 ty::Never => throw_validation_failure!(self.path, NeverVal),
767 ty::Foreign(..) | ty::FnDef(..) => {
768 // Nothing to check.
769 interp_ok(true)
770 }
771 ty::UnsafeBinder(_) => todo!("FIXME(unsafe_binder)"),
772 // The above should be all the primitive types. The rest is compound, we
773 // check them by visiting their fields/variants.
774 ty::Adt(..)
775 | ty::Tuple(..)
776 | ty::Array(..)
777 | ty::Slice(..)
778 | ty::Str
779 | ty::Dynamic(..)
780 | ty::Closure(..)
781 | ty::Pat(..)
782 | ty::CoroutineClosure(..)
783 | ty::Coroutine(..) => interp_ok(false),
784 // Some types only occur during typechecking, they have no layout.
785 // We should not see them here and we could not check them anyway.
786 ty::Error(_)
787 | ty::Infer(..)
788 | ty::Placeholder(..)
789 | ty::Bound(..)
790 | ty::Param(..)
791 | ty::Alias(..)
792 | ty::CoroutineWitness(..) => bug!("Encountered invalid type {:?}", ty),
793 }
794 }
795
796 fn visit_scalar(
797 &mut self,
798 scalar: Scalar<M::Provenance>,
799 scalar_layout: ScalarAbi,
800 ) -> InterpResult<'tcx> {
801 let size = scalar_layout.size(self.ecx);
802 let valid_range = scalar_layout.valid_range(self.ecx);
803 let WrappingRange { start, end } = valid_range;
804 let max_value = size.unsigned_int_max();
805 assert!(end <= max_value);
806 let bits = match scalar.try_to_scalar_int() {
807 Ok(int) => int.to_bits(size),
808 Err(_) => {
809 // So this is a pointer then, and casting to an int failed.
810 // Can only happen during CTFE.
811 // We support 2 kinds of ranges here: full range, and excluding zero.
812 if start == 1 && end == max_value {
813 // Only null is the niche. So make sure the ptr is NOT null.
814 if self.ecx.scalar_may_be_null(scalar)? {
815 throw_validation_failure!(
816 self.path,
817 NullablePtrOutOfRange { range: valid_range, max_value }
818 )
819 } else {
820 return interp_ok(());
821 }
822 } else if scalar_layout.is_always_valid(self.ecx) {
823 // Easy. (This is reachable if `enforce_number_validity` is set.)
824 return interp_ok(());
825 } else {
826 // Conservatively, we reject, because the pointer *could* have a bad
827 // value.
828 throw_validation_failure!(
829 self.path,
830 PtrOutOfRange { range: valid_range, max_value }
831 )
832 }
833 }
834 };
835 // Now compare.
836 if valid_range.contains(bits) {
837 interp_ok(())
838 } else {
839 throw_validation_failure!(
840 self.path,
841 OutOfRange { value: format!("{bits}"), range: valid_range, max_value }
842 )
843 }
844 }
845
846 fn in_mutable_memory(&self, val: &PlaceTy<'tcx, M::Provenance>) -> bool {
847 debug_assert!(self.ctfe_mode.is_some());
848 if let Some(mplace) = val.as_mplace_or_local().left() {
849 if let Some(alloc_id) = mplace.ptr().provenance.and_then(|p| p.get_alloc_id()) {
850 let tcx = *self.ecx.tcx;
851 // Everything must be already interned.
852 let mutbl = tcx.global_alloc(alloc_id).mutability(tcx, self.ecx.typing_env);
853 if let Some((_, alloc)) = self.ecx.memory.alloc_map.get(alloc_id) {
854 assert_eq!(alloc.mutability, mutbl);
855 }
856 mutbl.is_mut()
857 } else {
858 // No memory at all.
859 false
860 }
861 } else {
862 // A local variable -- definitely mutable.
863 true
864 }
865 }
866
867 /// Add the given pointer-length pair to the "data" range of this visit.
868 fn add_data_range(&mut self, ptr: Pointer<Option<M::Provenance>>, size: Size) {
869 if let Some(data_bytes) = self.data_bytes.as_mut() {
870 // We only have to store the offset, the rest is the same for all pointers here.
871 let (_prov, offset) = ptr.into_parts();
872 // Add this.
873 data_bytes.add_range(offset, size);
874 };
875 }
876
877 /// Add the entire given place to the "data" range of this visit.
878 fn add_data_range_place(&mut self, place: &PlaceTy<'tcx, M::Provenance>) {
879 // Only sized places can be added this way.
880 debug_assert!(place.layout.is_sized());
881 if let Some(data_bytes) = self.data_bytes.as_mut() {
882 let offset = Self::data_range_offset(self.ecx, place);
883 data_bytes.add_range(offset, place.layout.size);
884 }
885 }
886
887 /// Convert a place into the offset it starts at, for the purpose of data_range tracking.
888 /// Must only be called if `data_bytes` is `Some(_)`.
889 fn data_range_offset(ecx: &InterpCx<'tcx, M>, place: &PlaceTy<'tcx, M::Provenance>) -> Size {
890 // The presence of `data_bytes` implies that our place is in memory.
891 let ptr = ecx
892 .place_to_op(place)
893 .expect("place must be in memory")
894 .as_mplace_or_imm()
895 .expect_left("place must be in memory")
896 .ptr();
897 let (_prov, offset) = ptr.into_parts();
898 offset
899 }
900
901 fn reset_padding(&mut self, place: &PlaceTy<'tcx, M::Provenance>) -> InterpResult<'tcx> {
902 let Some(data_bytes) = self.data_bytes.as_mut() else { return interp_ok(()) };
903 // Our value must be in memory, otherwise we would not have set up `data_bytes`.
904 let mplace = self.ecx.force_allocation(place)?;
905 // Determine starting offset and size.
906 let (_prov, start_offset) = mplace.ptr().into_parts();
907 let (size, _align) = self
908 .ecx
909 .size_and_align_of_val(&mplace)?
910 .unwrap_or((mplace.layout.size, mplace.layout.align.abi));
911 // If there is no padding at all, we can skip the rest: check for
912 // a single data range covering the entire value.
913 if data_bytes.0 == &[(start_offset, size)] {
914 return interp_ok(());
915 }
916 // Get a handle for the allocation. Do this only once, to avoid looking up the same
917 // allocation over and over again. (Though to be fair, iterating the value already does
918 // exactly that.)
919 let Some(mut alloc) = self.ecx.get_ptr_alloc_mut(mplace.ptr(), size)? else {
920 // A ZST, no padding to clear.
921 return interp_ok(());
922 };
923 // Add a "finalizer" data range at the end, so that the iteration below finds all gaps
924 // between ranges.
925 data_bytes.0.push((start_offset + size, Size::ZERO));
926 // Iterate, and reset gaps.
927 let mut padding_cleared_until = start_offset;
928 for &(offset, size) in data_bytes.0.iter() {
929 assert!(
930 offset >= padding_cleared_until,
931 "reset_padding on {}: previous field ended at offset {}, next field starts at {} (and has a size of {} bytes)",
932 mplace.layout.ty,
933 (padding_cleared_until - start_offset).bytes(),
934 (offset - start_offset).bytes(),
935 size.bytes(),
936 );
937 if offset > padding_cleared_until {
938 // We found padding. Adjust the range to be relative to `alloc`, and make it uninit.
939 let padding_start = padding_cleared_until - start_offset;
940 let padding_size = offset - padding_cleared_until;
941 let range = alloc_range(padding_start, padding_size);
942 trace!("reset_padding on {}: resetting padding range {range:?}", mplace.layout.ty);
943 alloc.write_uninit(range)?;
944 }
945 padding_cleared_until = offset + size;
946 }
947 assert!(padding_cleared_until == start_offset + size);
948 interp_ok(())
949 }
950
951 /// Computes the data range of this union type:
952 /// which bytes are inside a field (i.e., not padding.)
953 fn union_data_range<'e>(
954 ecx: &'e mut InterpCx<'tcx, M>,
955 layout: TyAndLayout<'tcx>,
956 ) -> Cow<'e, RangeSet> {
957 assert!(layout.ty.is_union());
958 assert!(layout.is_sized(), "there are no unsized unions");
959 let layout_cx = LayoutCx::new(*ecx.tcx, ecx.typing_env);
960 return M::cached_union_data_range(ecx, layout.ty, || {
961 let mut out = RangeSet(Vec::new());
962 union_data_range_uncached(&layout_cx, layout, Size::ZERO, &mut out);
963 out
964 });
965
966 /// Helper for recursive traversal: add data ranges of the given type to `out`.
967 fn union_data_range_uncached<'tcx>(
968 cx: &LayoutCx<'tcx>,
969 layout: TyAndLayout<'tcx>,
970 base_offset: Size,
971 out: &mut RangeSet,
972 ) {
973 // If this is a ZST, we don't contain any data. In particular, this helps us to quickly
974 // skip over huge arrays of ZST.
975 if layout.is_zst() {
976 return;
977 }
978 // Just recursively add all the fields of everything to the output.
979 match &layout.fields {
980 FieldsShape::Primitive => {
981 out.add_range(base_offset, layout.size);
982 }
983 &FieldsShape::Union(fields) => {
984 // Currently, all fields start at offset 0 (relative to `base_offset`).
985 for field in 0..fields.get() {
986 let field = layout.field(cx, field);
987 union_data_range_uncached(cx, field, base_offset, out);
988 }
989 }
990 &FieldsShape::Array { stride, count } => {
991 let elem = layout.field(cx, 0);
992
993 // Fast-path for large arrays of simple types that do not contain any padding.
994 if elem.backend_repr.is_scalar() {
995 out.add_range(base_offset, elem.size * count);
996 } else {
997 for idx in 0..count {
998 // This repeats the same computation for every array element... but the alternative
999 // is to allocate temporary storage for a dedicated `out` set for the array element,
1000 // and replicating that N times. Is that better?
1001 union_data_range_uncached(cx, elem, base_offset + idx * stride, out);
1002 }
1003 }
1004 }
1005 FieldsShape::Arbitrary { offsets, .. } => {
1006 for (field, &offset) in offsets.iter_enumerated() {
1007 let field = layout.field(cx, field.as_usize());
1008 union_data_range_uncached(cx, field, base_offset + offset, out);
1009 }
1010 }
1011 }
1012 // Don't forget potential other variants.
1013 match &layout.variants {
1014 Variants::Single { .. } | Variants::Empty => {
1015 // Fully handled above.
1016 }
1017 Variants::Multiple { variants, .. } => {
1018 for variant in variants.indices() {
1019 let variant = layout.for_variant(cx, variant);
1020 union_data_range_uncached(cx, variant, base_offset, out);
1021 }
1022 }
1023 }
1024 }
1025 }
1026}
1027
1028impl<'rt, 'tcx, M: Machine<'tcx>> ValueVisitor<'tcx, M> for ValidityVisitor<'rt, 'tcx, M> {
1029 type V = PlaceTy<'tcx, M::Provenance>;
1030
1031 #[inline(always)]
1032 fn ecx(&self) -> &InterpCx<'tcx, M> {
1033 self.ecx
1034 }
1035
1036 fn read_discriminant(
1037 &mut self,
1038 val: &PlaceTy<'tcx, M::Provenance>,
1039 ) -> InterpResult<'tcx, VariantIdx> {
1040 self.with_elem(PathElem::EnumTag, move |this| {
1041 interp_ok(try_validation!(
1042 this.ecx.read_discriminant(val),
1043 this.path,
1044 Ub(InvalidTag(val)) => InvalidEnumTag {
1045 value: format!("{val:x}"),
1046 },
1047 Ub(UninhabitedEnumVariantRead(_)) => UninhabitedEnumVariant,
1048 // Uninit / bad provenance are not possible since the field was already previously
1049 // checked at its integer type.
1050 ))
1051 })
1052 }
1053
1054 #[inline]
1055 fn visit_field(
1056 &mut self,
1057 old_val: &PlaceTy<'tcx, M::Provenance>,
1058 field: usize,
1059 new_val: &PlaceTy<'tcx, M::Provenance>,
1060 ) -> InterpResult<'tcx> {
1061 let elem = self.aggregate_field_path_elem(old_val.layout, field);
1062 self.with_elem(elem, move |this| this.visit_value(new_val))
1063 }
1064
1065 #[inline]
1066 fn visit_variant(
1067 &mut self,
1068 old_val: &PlaceTy<'tcx, M::Provenance>,
1069 variant_id: VariantIdx,
1070 new_val: &PlaceTy<'tcx, M::Provenance>,
1071 ) -> InterpResult<'tcx> {
1072 let name = match old_val.layout.ty.kind() {
1073 ty::Adt(adt, _) => PathElem::Variant(adt.variant(variant_id).name),
1074 // Coroutines also have variants
1075 ty::Coroutine(..) => PathElem::CoroutineState(variant_id),
1076 _ => bug!("Unexpected type with variant: {:?}", old_val.layout.ty),
1077 };
1078 self.with_elem(name, move |this| this.visit_value(new_val))
1079 }
1080
1081 #[inline(always)]
1082 fn visit_union(
1083 &mut self,
1084 val: &PlaceTy<'tcx, M::Provenance>,
1085 _fields: NonZero<usize>,
1086 ) -> InterpResult<'tcx> {
1087 // Special check for CTFE validation, preventing `UnsafeCell` inside unions in immutable memory.
1088 if self.ctfe_mode.is_some_and(|c| !c.allow_immutable_unsafe_cell()) {
1089 // Unsized unions are currently not a thing, but let's keep this code consistent with
1090 // the check in `visit_value`.
1091 let zst = self.ecx.size_and_align_of_val(val)?.is_some_and(|(s, _a)| s.bytes() == 0);
1092 if !zst && !val.layout.ty.is_freeze(*self.ecx.tcx, self.ecx.typing_env) {
1093 if !self.in_mutable_memory(val) {
1094 throw_validation_failure!(self.path, UnsafeCellInImmutable);
1095 }
1096 }
1097 }
1098 if self.reset_provenance_and_padding
1099 && let Some(data_bytes) = self.data_bytes.as_mut()
1100 {
1101 let base_offset = Self::data_range_offset(self.ecx, val);
1102 // Determine and add data range for this union.
1103 let union_data_range = Self::union_data_range(self.ecx, val.layout);
1104 for &(offset, size) in union_data_range.0.iter() {
1105 data_bytes.add_range(base_offset + offset, size);
1106 }
1107 }
1108 interp_ok(())
1109 }
1110
1111 #[inline]
1112 fn visit_box(
1113 &mut self,
1114 _box_ty: Ty<'tcx>,
1115 val: &PlaceTy<'tcx, M::Provenance>,
1116 ) -> InterpResult<'tcx> {
1117 self.check_safe_pointer(val, PointerKind::Box)?;
1118 interp_ok(())
1119 }
1120
1121 #[inline]
1122 fn visit_value(&mut self, val: &PlaceTy<'tcx, M::Provenance>) -> InterpResult<'tcx> {
1123 trace!("visit_value: {:?}, {:?}", *val, val.layout);
1124
1125 // Check primitive types -- the leaves of our recursive descent.
1126 // This is called even for enum discriminants (which are "fields" of their enum),
1127 // so for integer-typed discriminants the provenance reset will happen here.
1128 // We assume that the Scalar validity range does not restrict these values
1129 // any further than `try_visit_primitive` does!
1130 if self.try_visit_primitive(val)? {
1131 return interp_ok(());
1132 }
1133
1134 // Special check preventing `UnsafeCell` in the inner part of constants
1135 if self.ctfe_mode.is_some_and(|c| !c.allow_immutable_unsafe_cell()) {
1136 // Exclude ZST values. We need to compute the dynamic size/align to properly
1137 // handle slices and trait objects.
1138 let zst = self.ecx.size_and_align_of_val(val)?.is_some_and(|(s, _a)| s.bytes() == 0);
1139 if !zst
1140 && let Some(def) = val.layout.ty.ty_adt_def()
1141 && def.is_unsafe_cell()
1142 {
1143 if !self.in_mutable_memory(val) {
1144 throw_validation_failure!(self.path, UnsafeCellInImmutable);
1145 }
1146 }
1147 }
1148
1149 // Recursively walk the value at its type. Apply optimizations for some large types.
1150 match val.layout.ty.kind() {
1151 ty::Str => {
1152 let mplace = val.assert_mem_place(); // strings are unsized and hence never immediate
1153 let len = mplace.len(self.ecx)?;
1154 try_validation!(
1155 self.ecx.read_bytes_ptr_strip_provenance(mplace.ptr(), Size::from_bytes(len)),
1156 self.path,
1157 Ub(InvalidUninitBytes(..)) => Uninit { expected: ExpectedKind::Str },
1158 Unsup(ReadPointerAsInt(_)) => PointerAsInt { expected: ExpectedKind::Str }
1159 );
1160 }
1161 ty::Array(tys, ..) | ty::Slice(tys)
1162 // This optimization applies for types that can hold arbitrary non-provenance bytes (such as
1163 // integer and floating point types).
1164 // FIXME(wesleywiser) This logic could be extended further to arbitrary structs or
1165 // tuples made up of integer/floating point types or inhabited ZSTs with no padding.
1166 if matches!(tys.kind(), ty::Int(..) | ty::Uint(..) | ty::Float(..))
1167 =>
1168 {
1169 let expected = if tys.is_integral() { ExpectedKind::Int } else { ExpectedKind::Float };
1170 // Optimized handling for arrays of integer/float type.
1171
1172 // This is the length of the array/slice.
1173 let len = val.len(self.ecx)?;
1174 // This is the element type size.
1175 let layout = self.ecx.layout_of(*tys)?;
1176 // This is the size in bytes of the whole array. (This checks for overflow.)
1177 let size = layout.size * len;
1178 // If the size is 0, there is nothing to check.
1179 // (`size` can only be 0 if `len` is 0, and empty arrays are always valid.)
1180 if size == Size::ZERO {
1181 return interp_ok(());
1182 }
1183 // Now that we definitely have a non-ZST array, we know it lives in memory -- except it may
1184 // be an uninitialized local variable, those are also "immediate".
1185 let mplace = match val.to_op(self.ecx)?.as_mplace_or_imm() {
1186 Left(mplace) => mplace,
1187 Right(imm) => match *imm {
1188 Immediate::Uninit =>
1189 throw_validation_failure!(self.path, Uninit { expected }),
1190 Immediate::Scalar(..) | Immediate::ScalarPair(..) =>
1191 bug!("arrays/slices can never have Scalar/ScalarPair layout"),
1192 }
1193 };
1194
1195 // Optimization: we just check the entire range at once.
1196 // NOTE: Keep this in sync with the handling of integer and float
1197 // types above, in `visit_primitive`.
1198 // No need for an alignment check here, this is not an actual memory access.
1199 let alloc = self.ecx.get_ptr_alloc(mplace.ptr(), size)?.expect("we already excluded size 0");
1200
1201 alloc.get_bytes_strip_provenance().map_err_kind(|kind| {
1202 // Some error happened, try to provide a more detailed description.
1203 // For some errors we might be able to provide extra information.
1204 // (This custom logic does not fit the `try_validation!` macro.)
1205 match kind {
1206 Ub(InvalidUninitBytes(Some((_alloc_id, access)))) | Unsup(ReadPointerAsInt(Some((_alloc_id, access)))) => {
1207 // Some byte was uninitialized, determine which
1208 // element that byte belongs to so we can
1209 // provide an index.
1210 let i = usize::try_from(
1211 access.bad.start.bytes() / layout.size.bytes(),
1212 )
1213 .unwrap();
1214 self.path.push(PathElem::ArrayElem(i));
1215
1216 if matches!(kind, Ub(InvalidUninitBytes(_))) {
1217 err_validation_failure!(self.path, Uninit { expected })
1218 } else {
1219 err_validation_failure!(self.path, PointerAsInt { expected })
1220 }
1221 }
1222
1223 // Propagate upwards (that will also check for unexpected errors).
1224 err => err,
1225 }
1226 })?;
1227
1228 // Don't forget that these are all non-pointer types, and thus do not preserve
1229 // provenance.
1230 if self.reset_provenance_and_padding {
1231 // We can't share this with above as above, we might be looking at read-only memory.
1232 let mut alloc = self.ecx.get_ptr_alloc_mut(mplace.ptr(), size)?.expect("we already excluded size 0");
1233 alloc.clear_provenance()?;
1234 // Also, mark this as containing data, not padding.
1235 self.add_data_range(mplace.ptr(), size);
1236 }
1237 }
1238 // Fast path for arrays and slices of ZSTs. We only need to check a single ZST element
1239 // of an array and not all of them, because there's only a single value of a specific
1240 // ZST type, so either validation fails for all elements or none.
1241 ty::Array(tys, ..) | ty::Slice(tys) if self.ecx.layout_of(*tys)?.is_zst() => {
1242 // Validate just the first element (if any).
1243 if val.len(self.ecx)? > 0 {
1244 self.visit_field(val, 0, &self.ecx.project_index(val, 0)?)?;
1245 }
1246 }
1247 ty::Pat(base, pat) => {
1248 // First check that the base type is valid
1249 self.visit_value(&val.transmute(self.ecx.layout_of(*base)?, self.ecx)?)?;
1250 // When you extend this match, make sure to also add tests to
1251 // tests/ui/type/pattern_types/validity.rs((
1252 match **pat {
1253 // Range patterns are precisely reflected into `valid_range` and thus
1254 // handled fully by `visit_scalar` (called below).
1255 ty::PatternKind::Range { .. } => {},
1256
1257 // FIXME(pattern_types): check that the value is covered by one of the variants.
1258 // For now, we rely on layout computation setting the scalar's `valid_range` to
1259 // match the pattern. However, this cannot always work; the layout may
1260 // pessimistically cover actually illegal ranges and Miri would miss that UB.
1261 // The consolation here is that codegen also will miss that UB, so at least
1262 // we won't see optimizations actually breaking such programs.
1263 ty::PatternKind::Or(_patterns) => {}
1264 }
1265 }
1266 _ => {
1267 // default handler
1268 try_validation!(
1269 self.walk_value(val),
1270 self.path,
1271 // It's not great to catch errors here, since we can't give a very good path,
1272 // but it's better than ICEing.
1273 Ub(InvalidVTableTrait { vtable_dyn_type, expected_dyn_type }) => {
1274 InvalidMetaWrongTrait { vtable_dyn_type, expected_dyn_type }
1275 },
1276 );
1277 }
1278 }
1279
1280 // *After* all of this, check further information stored in the layout. We need to check
1281 // this to handle types like `NonNull` where the `Scalar` info is more restrictive than what
1282 // the fields say (`rustc_layout_scalar_valid_range_start`). But in most cases, this will
1283 // just propagate what the fields say, and then we want the error to point at the field --
1284 // so, we first recurse, then we do this check.
1285 //
1286 // FIXME: We could avoid some redundant checks here. For newtypes wrapping
1287 // scalars, we do the same check on every "level" (e.g., first we check
1288 // MyNewtype and then the scalar in there).
1289 if val.layout.is_uninhabited() {
1290 let ty = val.layout.ty;
1291 throw_validation_failure!(self.path, UninhabitedVal { ty });
1292 }
1293 match val.layout.backend_repr {
1294 BackendRepr::Scalar(scalar_layout) => {
1295 if !scalar_layout.is_uninit_valid() {
1296 // There is something to check here.
1297 let scalar = self.read_scalar(val, ExpectedKind::InitScalar)?;
1298 self.visit_scalar(scalar, scalar_layout)?;
1299 }
1300 }
1301 BackendRepr::ScalarPair(a_layout, b_layout) => {
1302 // We can only proceed if *both* scalars need to be initialized.
1303 // FIXME: find a way to also check ScalarPair when one side can be uninit but
1304 // the other must be init.
1305 if !a_layout.is_uninit_valid() && !b_layout.is_uninit_valid() {
1306 let (a, b) =
1307 self.read_immediate(val, ExpectedKind::InitScalar)?.to_scalar_pair();
1308 self.visit_scalar(a, a_layout)?;
1309 self.visit_scalar(b, b_layout)?;
1310 }
1311 }
1312 BackendRepr::SimdVector { .. } => {
1313 // No checks here, we assume layout computation gets this right.
1314 // (This is harder to check since Miri does not represent these as `Immediate`. We
1315 // also cannot use field projections since this might be a newtype around a vector.)
1316 }
1317 BackendRepr::Memory { .. } => {
1318 // Nothing to do.
1319 }
1320 }
1321
1322 interp_ok(())
1323 }
1324}
1325
1326impl<'tcx, M: Machine<'tcx>> InterpCx<'tcx, M> {
1327 fn validate_operand_internal(
1328 &mut self,
1329 val: &PlaceTy<'tcx, M::Provenance>,
1330 path: Vec<PathElem>,
1331 ref_tracking: Option<&mut RefTracking<MPlaceTy<'tcx, M::Provenance>, Vec<PathElem>>>,
1332 ctfe_mode: Option<CtfeValidationMode>,
1333 reset_provenance_and_padding: bool,
1334 ) -> InterpResult<'tcx> {
1335 trace!("validate_operand_internal: {:?}, {:?}", *val, val.layout.ty);
1336
1337 // Run the visitor.
1338 self.run_for_validation_mut(|ecx| {
1339 let reset_padding = reset_provenance_and_padding && {
1340 // Check if `val` is actually stored in memory. If not, padding is not even
1341 // represented and we need not reset it.
1342 ecx.place_to_op(val)?.as_mplace_or_imm().is_left()
1343 };
1344 let mut v = ValidityVisitor {
1345 path,
1346 ref_tracking,
1347 ctfe_mode,
1348 ecx,
1349 reset_provenance_and_padding,
1350 data_bytes: reset_padding.then_some(RangeSet(Vec::new())),
1351 };
1352 v.visit_value(val)?;
1353 v.reset_padding(val)?;
1354 interp_ok(())
1355 })
1356 .map_err_info(|err| {
1357 if !matches!(
1358 err.kind(),
1359 err_ub!(ValidationError { .. })
1360 | InterpErrorKind::InvalidProgram(_)
1361 | InterpErrorKind::Unsupported(UnsupportedOpInfo::ExternTypeField)
1362 ) {
1363 bug!(
1364 "Unexpected error during validation: {}",
1365 format_interp_error(self.tcx.dcx(), err)
1366 );
1367 }
1368 err
1369 })
1370 }
1371
1372 /// This function checks the data at `val` to be const-valid.
1373 /// `val` is assumed to cover valid memory if it is an indirect operand.
1374 /// It will error if the bits at the destination do not match the ones described by the layout.
1375 ///
1376 /// `ref_tracking` is used to record references that we encounter so that they
1377 /// can be checked recursively by an outside driving loop.
1378 ///
1379 /// `constant` controls whether this must satisfy the rules for constants:
1380 /// - no pointers to statics.
1381 /// - no `UnsafeCell` or non-ZST `&mut`.
1382 #[inline(always)]
1383 pub(crate) fn const_validate_operand(
1384 &mut self,
1385 val: &PlaceTy<'tcx, M::Provenance>,
1386 path: Vec<PathElem>,
1387 ref_tracking: &mut RefTracking<MPlaceTy<'tcx, M::Provenance>, Vec<PathElem>>,
1388 ctfe_mode: CtfeValidationMode,
1389 ) -> InterpResult<'tcx> {
1390 self.validate_operand_internal(
1391 val,
1392 path,
1393 Some(ref_tracking),
1394 Some(ctfe_mode),
1395 /*reset_provenance*/ false,
1396 )
1397 }
1398
1399 /// This function checks the data at `val` to be runtime-valid.
1400 /// `val` is assumed to cover valid memory if it is an indirect operand.
1401 /// It will error if the bits at the destination do not match the ones described by the layout.
1402 #[inline(always)]
1403 pub fn validate_operand(
1404 &mut self,
1405 val: &PlaceTy<'tcx, M::Provenance>,
1406 recursive: bool,
1407 reset_provenance_and_padding: bool,
1408 ) -> InterpResult<'tcx> {
1409 let _span = enter_trace_span!(
1410 M,
1411 "validate_operand",
1412 "recursive={recursive}, reset_provenance_and_padding={reset_provenance_and_padding}, val={val:?}"
1413 );
1414
1415 // Note that we *could* actually be in CTFE here with `-Zextra-const-ub-checks`, but it's
1416 // still correct to not use `ctfe_mode`: that mode is for validation of the final constant
1417 // value, it rules out things like `UnsafeCell` in awkward places.
1418 if !recursive {
1419 return self.validate_operand_internal(
1420 val,
1421 vec![],
1422 None,
1423 None,
1424 reset_provenance_and_padding,
1425 );
1426 }
1427 // Do a recursive check.
1428 let mut ref_tracking = RefTracking::empty();
1429 self.validate_operand_internal(
1430 val,
1431 vec![],
1432 Some(&mut ref_tracking),
1433 None,
1434 reset_provenance_and_padding,
1435 )?;
1436 while let Some((mplace, path)) = ref_tracking.todo.pop() {
1437 // Things behind reference do *not* have the provenance reset.
1438 self.validate_operand_internal(
1439 &mplace.into(),
1440 path,
1441 Some(&mut ref_tracking),
1442 None,
1443 /*reset_provenance_and_padding*/ false,
1444 )?;
1445 }
1446 interp_ok(())
1447 }
1448}