Skip to content

Commit

Permalink
Rollup merge of #130229 - RalfJung:ptr-offset-unsigned, r=scottmcm
Browse files Browse the repository at this point in the history 
ptr::add/sub: do not claim equivalence with `offset(c as isize)`

In #110837, the `offset` intrinsic got changed to also allow a `usize` offset parameter. The intention is that this will do an unsigned multiplication with the size, and we have UB if that overflows -- and we also have UB if the result is larger than `usize::MAX`, i.e., if a subsequent cast to `isize` would wrap. ~~The LLVM backend sets some attributes accordingly.~~

This updates the docs for `add`/`sub` to match that intent, in preparation for adjusting codegen to exploit this UB. We use this opportunity to clarify what the exact requirements are: we compute the offset using mathematical multiplication (so it's no problem to have an `isize * usize` multiplication, we just multiply integers), and the result must fit in an `isize`.
Cc `@rust-lang/opsem` `@nikic`

#130239 updates Miri to detect this UB.

`sub` still has some cases of UB not reflected in the underlying intrinsic semantics (and Miri does not catch): when we subtract `usize::MAX`, then after casting to `isize` that's just `-1` so we end up adding one unit without noticing any UB, but actually the offset we gave does not fit in an `isize`. Miri will currently still not complain for such cases:
```rust
fn main() {
    let x = &[0i32; 2];
    let x = x.as_ptr();
    // This should be UB, we are subtracting way too much.
    unsafe { x.sub(usize::MAX).read() };
}
```
However, the LLVM IR we generate here also is UB-free. This is "just" library UB but not language UB.
Cc `@saethlin;` might be worth adding precondition checks against overflow on `offset`/`add`/`sub`?

Fixes #130211
  • Loading branch information
@matthiaskrgr
matthiaskrgr authored Oct 1, 2024
2 parents 389a399 + bc3d072 commit 97cdc8e
Show file tree
Hide file tree
Showing 3 changed files with 54 additions and 44 deletions.
3 changes: 1 addition & 2 deletions library/core/src/intrinsics.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1425,8 +1425,7 @@ extern "rust-intrinsic" {
///
/// If the computed offset is non-zero, then both the starting and resulting pointer must be
/// either in bounds or at the end of an allocated object. If either pointer is out
/// of bounds or arithmetic overflow occurs then any further use of the returned value will
/// result in undefined behavior.
/// of bounds or arithmetic overflow occurs then this operation is undefined behavior.
///
/// The stabilized version of this intrinsic is [`pointer::offset`].
#[must_use = "returns a new pointer rather than modifying its argument"]
Expand Down
47 changes: 26 additions & 21 deletions library/core/src/ptr/const_ptr.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -346,7 +346,7 @@ impl<T: ?Sized> *const T {
if self.is_null() { None } else { Some(unsafe { &*(self as *const MaybeUninit<T>) }) }
}

/// Adds an offset to a pointer.
/// Adds a signed offset to a pointer.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
Expand All @@ -355,7 +355,8 @@ impl<T: ?Sized> *const T {
///
/// If any of the following conditions are violated, the result is Undefined Behavior:
///
/// * The computed offset, `count * size_of::<T>()` bytes, must not overflow `isize`.
/// * The offset in bytes, `count * size_of::<T>()`, computed on mathematical integers (without
/// "wrapping around"), must fit in an `isize`.
///
/// * If the computed offset is non-zero, then `self` must be derived from a pointer to some
/// [allocated object], and the entire memory range between `self` and the result must be in
Expand Down Expand Up @@ -398,7 +399,7 @@ impl<T: ?Sized> *const T {
unsafe { intrinsics::offset(self, count) }
}

/// Calculates the offset from a pointer in bytes.
/// Adds a signed offset in bytes to a pointer.
///
/// `count` is in units of **bytes**.
///
Expand All @@ -418,7 +419,7 @@ impl<T: ?Sized> *const T {
unsafe { self.cast::<u8>().offset(count).with_metadata_of(self) }
}

/// Calculates the offset from a pointer using wrapping arithmetic.
/// Adds a signed offset to a pointer using wrapping arithmetic.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
Expand Down Expand Up @@ -480,7 +481,7 @@ impl<T: ?Sized> *const T {
unsafe { intrinsics::arith_offset(self, count) }
}

/// Calculates the offset from a pointer in bytes using wrapping arithmetic.
/// Adds a signed offset in bytes to a pointer using wrapping arithmetic.
///
/// `count` is in units of **bytes**.
///
Expand Down Expand Up @@ -804,7 +805,11 @@ impl<T: ?Sized> *const T {
}
}

/// Adds an offset to a pointer (convenience for `.offset(count as isize)`).
/// Adds an unsigned offset to a pointer.
///
/// This can only move the pointer forward (or not move it). If you need to move forward or
/// backward depending on the value, then you might want [`offset`](#method.offset) instead
/// which takes a signed offset.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
Expand All @@ -813,7 +818,8 @@ impl<T: ?Sized> *const T {
///
/// If any of the following conditions are violated, the result is Undefined Behavior:
///
/// * The computed offset, `count * size_of::<T>()` bytes, must not overflow `isize`.
/// * The offset in bytes, `count * size_of::<T>()`, computed on mathematical integers (without
/// "wrapping around"), must fit in an `isize`.
///
/// * If the computed offset is non-zero, then `self` must be derived from a pointer to some
/// [allocated object], and the entire memory range between `self` and the result must be in
Expand Down Expand Up @@ -856,7 +862,7 @@ impl<T: ?Sized> *const T {
unsafe { intrinsics::offset(self, count) }
}

/// Calculates the offset from a pointer in bytes (convenience for `.byte_offset(count as isize)`).
/// Adds an unsigned offset in bytes to a pointer.
///
/// `count` is in units of bytes.
///
Expand All @@ -876,8 +882,11 @@ impl<T: ?Sized> *const T {
unsafe { self.cast::<u8>().add(count).with_metadata_of(self) }
}

/// Subtracts an offset from a pointer (convenience for
/// `.offset((count as isize).wrapping_neg())`).
/// Subtracts an unsigned offset from a pointer.
///
/// This can only move the pointer backward (or not move it). If you need to move forward or
/// backward depending on the value, then you might want [`offset`](#method.offset) instead
/// which takes a signed offset.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
Expand All @@ -886,7 +895,8 @@ impl<T: ?Sized> *const T {
///
/// If any of the following conditions are violated, the result is Undefined Behavior:
///
/// * The computed offset, `count * size_of::<T>()` bytes, must not overflow `isize`.
/// * The offset in bytes, `count * size_of::<T>()`, computed on mathematical integers (without
/// "wrapping around"), must fit in an `isize`.
///
/// * If the computed offset is non-zero, then `self` must be derived from a pointer to some
/// [allocated object], and the entire memory range between `self` and the result must be in
Expand Down Expand Up @@ -937,8 +947,7 @@ impl<T: ?Sized> *const T {
}
}

/// Calculates the offset from a pointer in bytes (convenience for
/// `.byte_offset((count as isize).wrapping_neg())`).
/// Subtracts an unsigned offset in bytes from a pointer.
///
/// `count` is in units of bytes.
///
Expand All @@ -958,8 +967,7 @@ impl<T: ?Sized> *const T {
unsafe { self.cast::<u8>().sub(count).with_metadata_of(self) }
}

/// Calculates the offset from a pointer using wrapping arithmetic.
/// (convenience for `.wrapping_offset(count as isize)`)
/// Adds an unsigned offset to a pointer using wrapping arithmetic.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
Expand Down Expand Up @@ -1020,8 +1028,7 @@ impl<T: ?Sized> *const T {
self.wrapping_offset(count as isize)
}

/// Calculates the offset from a pointer in bytes using wrapping arithmetic.
/// (convenience for `.wrapping_byte_offset(count as isize)`)
/// Adds an unsigned offset in bytes to a pointer using wrapping arithmetic.
///
/// `count` is in units of bytes.
///
Expand All @@ -1038,8 +1045,7 @@ impl<T: ?Sized> *const T {
self.cast::<u8>().wrapping_add(count).with_metadata_of(self)
}

/// Calculates the offset from a pointer using wrapping arithmetic.
/// (convenience for `.wrapping_offset((count as isize).wrapping_neg())`)
/// Subtracts an unsigned offset from a pointer using wrapping arithmetic.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
Expand Down Expand Up @@ -1100,8 +1106,7 @@ impl<T: ?Sized> *const T {
self.wrapping_offset((count as isize).wrapping_neg())
}

/// Calculates the offset from a pointer in bytes using wrapping arithmetic.
/// (convenience for `.wrapping_offset((count as isize).wrapping_neg())`)
/// Subtracts an unsigned offset in bytes from a pointer using wrapping arithmetic.
///
/// `count` is in units of bytes.
///
Expand Down
48 changes: 27 additions & 21 deletions library/core/src/ptr/mut_ptr.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -344,7 +344,7 @@ impl<T: ?Sized> *mut T {
if self.is_null() { None } else { Some(unsafe { &*(self as *const MaybeUninit<T>) }) }
}

/// Adds an offset to a pointer.
/// Adds a signed offset to a pointer.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
Expand All @@ -353,7 +353,8 @@ impl<T: ?Sized> *mut T {
///
/// If any of the following conditions are violated, the result is Undefined Behavior:
///
/// * The computed offset, `count * size_of::<T>()` bytes, must not overflow `isize`.
/// * The offset in bytes, `count * size_of::<T>()`, computed on mathematical integers (without
/// "wrapping around"), must fit in an `isize`.
///
/// * If the computed offset is non-zero, then `self` must be derived from a pointer to some
/// [allocated object], and the entire memory range between `self` and the result must be in
Expand Down Expand Up @@ -398,7 +399,7 @@ impl<T: ?Sized> *mut T {
unsafe { intrinsics::offset(self, count) }
}

/// Calculates the offset from a pointer in bytes.
/// Adds a signed offset in bytes to a pointer.
///
/// `count` is in units of **bytes**.
///
Expand All @@ -418,7 +419,8 @@ impl<T: ?Sized> *mut T {
unsafe { self.cast::<u8>().offset(count).with_metadata_of(self) }
}

/// Calculates the offset from a pointer using wrapping arithmetic.
/// Adds a signed offset to a pointer using wrapping arithmetic.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
///
Expand Down Expand Up @@ -477,7 +479,7 @@ impl<T: ?Sized> *mut T {
unsafe { intrinsics::arith_offset(self, count) as *mut T }
}

/// Calculates the offset from a pointer in bytes using wrapping arithmetic.
/// Adds a signed offset in bytes to a pointer using wrapping arithmetic.
///
/// `count` is in units of **bytes**.
///
Expand Down Expand Up @@ -885,7 +887,11 @@ impl<T: ?Sized> *mut T {
unsafe { (self as *const T).sub_ptr(origin) }
}

/// Adds an offset to a pointer (convenience for `.offset(count as isize)`).
/// Adds an unsigned offset to a pointer.
///
/// This can only move the pointer forward (or not move it). If you need to move forward or
/// backward depending on the value, then you might want [`offset`](#method.offset) instead
/// which takes a signed offset.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
Expand All @@ -894,7 +900,8 @@ impl<T: ?Sized> *mut T {
///
/// If any of the following conditions are violated, the result is Undefined Behavior:
///
/// * The computed offset, `count * size_of::<T>()` bytes, must not overflow `isize`.
/// * The offset in bytes, `count * size_of::<T>()`, computed on mathematical integers (without
/// "wrapping around"), must fit in an `isize`.
///
/// * If the computed offset is non-zero, then `self` must be derived from a pointer to some
/// [allocated object], and the entire memory range between `self` and the result must be in
Expand Down Expand Up @@ -937,7 +944,7 @@ impl<T: ?Sized> *mut T {
unsafe { intrinsics::offset(self, count) }
}

/// Calculates the offset from a pointer in bytes (convenience for `.byte_offset(count as isize)`).
/// Adds an unsigned offset in bytes to a pointer.
///
/// `count` is in units of bytes.
///
Expand All @@ -957,8 +964,11 @@ impl<T: ?Sized> *mut T {
unsafe { self.cast::<u8>().add(count).with_metadata_of(self) }
}

/// Subtracts an offset from a pointer (convenience for
/// `.offset((count as isize).wrapping_neg())`).
/// Subtracts an unsigned offset from a pointer.
///
/// This can only move the pointer backward (or not move it). If you need to move forward or
/// backward depending on the value, then you might want [`offset`](#method.offset) instead
/// which takes a signed offset.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
Expand All @@ -967,7 +977,8 @@ impl<T: ?Sized> *mut T {
///
/// If any of the following conditions are violated, the result is Undefined Behavior:
///
/// * The computed offset, `count * size_of::<T>()` bytes, must not overflow `isize`.
/// * The offset in bytes, `count * size_of::<T>()`, computed on mathematical integers (without
/// "wrapping around"), must fit in an `isize`.
///
/// * If the computed offset is non-zero, then `self` must be derived from a pointer to some
/// [allocated object], and the entire memory range between `self` and the result must be in
Expand Down Expand Up @@ -1018,8 +1029,7 @@ impl<T: ?Sized> *mut T {
}
}

/// Calculates the offset from a pointer in bytes (convenience for
/// `.byte_offset((count as isize).wrapping_neg())`).
/// Subtracts an unsigned offset in bytes from a pointer.
///
/// `count` is in units of bytes.
///
Expand All @@ -1039,8 +1049,7 @@ impl<T: ?Sized> *mut T {
unsafe { self.cast::<u8>().sub(count).with_metadata_of(self) }
}

/// Calculates the offset from a pointer using wrapping arithmetic.
/// (convenience for `.wrapping_offset(count as isize)`)
/// Adds an unsigned offset to a pointer using wrapping arithmetic.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
Expand Down Expand Up @@ -1099,8 +1108,7 @@ impl<T: ?Sized> *mut T {
self.wrapping_offset(count as isize)
}

/// Calculates the offset from a pointer in bytes using wrapping arithmetic.
/// (convenience for `.wrapping_byte_offset(count as isize)`)
/// Adds an unsigned offset in bytes to a pointer using wrapping arithmetic.
///
/// `count` is in units of bytes.
///
Expand All @@ -1117,8 +1125,7 @@ impl<T: ?Sized> *mut T {
self.cast::<u8>().wrapping_add(count).with_metadata_of(self)
}

/// Calculates the offset from a pointer using wrapping arithmetic.
/// (convenience for `.wrapping_offset((count as isize).wrapping_neg())`)
/// Subtracts an unsigned offset from a pointer using wrapping arithmetic.
///
/// `count` is in units of T; e.g., a `count` of 3 represents a pointer
/// offset of `3 * size_of::<T>()` bytes.
Expand Down Expand Up @@ -1177,8 +1184,7 @@ impl<T: ?Sized> *mut T {
self.wrapping_offset((count as isize).wrapping_neg())
}

/// Calculates the offset from a pointer in bytes using wrapping arithmetic.
/// (convenience for `.wrapping_offset((count as isize).wrapping_neg())`)
/// Subtracts an unsigned offset in bytes from a pointer using wrapping arithmetic.
///
/// `count` is in units of bytes.
///
Expand Down

0 comments on commit 97cdc8e

Please sign in to comment.