From d5face2e6f16797ea297eaaaf25e53b8dd0e7d2e Mon Sep 17 00:00:00 2001 From: mlugg Date: Sun, 15 Dec 2024 14:54:57 +0000 Subject: [PATCH] Sema: disallow unsafe in-memory coercions The error messages here aren't amazing yet, but this is an improvement on status quo, because the current behavior allows false negative compile errors, so effectively miscompiles. Resolves: #15874 --- src/Sema.zig | 201 +++++++++++------- .../invalid_pointer_coercions.zig | 75 +++++++ 2 files changed, 200 insertions(+), 76 deletions(-) create mode 100644 test/cases/compile_errors/invalid_pointer_coercions.zig diff --git a/src/Sema.zig b/src/Sema.zig index f31e71047fa3..fbc091d7311b 100644 --- a/src/Sema.zig +++ b/src/Sema.zig @@ -31121,20 +31121,22 @@ fn pointerSizeString(size: std.builtin.Type.Pointer.Size) []const u8 { }; } -/// If pointers have the same representation in runtime memory, a bitcast AIR instruction -/// may be used for the coercion. -/// * `const` attribute can be gained -/// * `volatile` attribute can be gained -/// * `allowzero` attribute can be gained (whether from explicit attribute, C pointer, or optional pointer) but only if !dest_is_mut -/// * alignment can be decreased -/// * bit offset attributes must match exactly -/// * `*`/`[*]` must match exactly, but `[*c]` matches either one -/// * sentinel-terminated pointers can coerce into `[*]` +/// If types `A` and `B` have identical representations in runtime memory, they are considered +/// "in-memory coercible". This is a subset of normal coercions. Not only can `A` coerce to `B`, but +/// also, coercions can happen through pointers. For instance, `*const A` can coerce to `*const B`. +/// +/// If this function is called, the coercion must be applied, or a compile error emitted if `.ok` +/// is not returned. This is because this function may modify inferred error sets to make a +/// coercion possible, even if `.ok` is not returned. pub fn coerceInMemoryAllowed( sema: *Sema, block: *Block, dest_ty: Type, src_ty: Type, + /// If `true`, this query comes from an attempted coercion of the form `*Src` -> `*Dest`, where + /// both pointers are mutable. If this coercion is allowed, one could store to the `*Dest` and + /// load from the `*Src` to effectively perform an in-memory coercion from `Dest` to `Src`. + /// Therefore, when `dest_is_mut`, the in-memory coercion must be valid in *both directions*. dest_is_mut: bool, target: std.Target, dest_src: LazySrcLoc, @@ -31209,7 +31211,7 @@ pub fn coerceInMemoryAllowed( // Functions if (dest_tag == .@"fn" and src_tag == .@"fn") { - return try sema.coerceInMemoryAllowedFns(block, dest_ty, src_ty, target, dest_src, src_src); + return try sema.coerceInMemoryAllowedFns(block, dest_ty, src_ty, dest_is_mut, target, dest_src, src_src); } // Error Unions @@ -31218,7 +31220,7 @@ pub fn coerceInMemoryAllowed( const src_payload = src_ty.errorUnionPayload(zcu); const child = try sema.coerceInMemoryAllowed(block, dest_payload, src_payload, dest_is_mut, target, dest_src, src_src, null); if (child != .ok) { - return InMemoryCoercionResult{ .error_union_payload = .{ + return .{ .error_union_payload = .{ .child = try child.dupe(sema.arena), .actual = src_payload, .wanted = dest_payload, @@ -31229,7 +31231,11 @@ pub fn coerceInMemoryAllowed( // Error Sets if (dest_tag == .error_set and src_tag == .error_set) { - return try sema.coerceInMemoryAllowedErrorSets(block, dest_ty, src_ty, dest_src, src_src); + const res1 = try sema.coerceInMemoryAllowedErrorSets(block, dest_ty, src_ty, dest_src, src_src); + if (!dest_is_mut or res1 != .ok) return res1; + // src -> dest is okay, but `dest_is_mut`, so it needs to be allowed in the other direction. + const res2 = try sema.coerceInMemoryAllowedErrorSets(block, src_ty, dest_ty, src_src, dest_src); + return res2; } // Arrays @@ -31237,7 +31243,7 @@ pub fn coerceInMemoryAllowed( const dest_info = dest_ty.arrayInfo(zcu); const src_info = src_ty.arrayInfo(zcu); if (dest_info.len != src_info.len) { - return InMemoryCoercionResult{ .array_len = .{ + return .{ .array_len = .{ .actual = src_info.len, .wanted = dest_info.len, } }; @@ -31248,7 +31254,7 @@ pub fn coerceInMemoryAllowed( .ok => {}, .no_match => return child, else => { - return InMemoryCoercionResult{ .array_elem = .{ + return .{ .array_elem = .{ .child = try child.dupe(sema.arena), .actual = src_info.elem_type, .wanted = dest_info.elem_type, @@ -31264,7 +31270,7 @@ pub fn coerceInMemoryAllowed( zcu, )); if (!ok_sent) { - return InMemoryCoercionResult{ .array_sentinel = .{ + return .{ .array_sentinel = .{ .actual = src_info.sentinel orelse Value.@"unreachable", .wanted = dest_info.sentinel orelse Value.@"unreachable", .ty = dest_info.elem_type, @@ -31278,7 +31284,7 @@ pub fn coerceInMemoryAllowed( const dest_len = dest_ty.vectorLen(zcu); const src_len = src_ty.vectorLen(zcu); if (dest_len != src_len) { - return InMemoryCoercionResult{ .vector_len = .{ + return .{ .vector_len = .{ .actual = src_len, .wanted = dest_len, } }; @@ -31288,7 +31294,7 @@ pub fn coerceInMemoryAllowed( const src_elem_ty = src_ty.scalarType(zcu); const child = try sema.coerceInMemoryAllowed(block, dest_elem_ty, src_elem_ty, dest_is_mut, target, dest_src, src_src, null); if (child != .ok) { - return InMemoryCoercionResult{ .vector_elem = .{ + return .{ .vector_elem = .{ .child = try child.dupe(sema.arena), .actual = src_elem_ty, .wanted = dest_elem_ty, @@ -31305,7 +31311,7 @@ pub fn coerceInMemoryAllowed( const dest_len = dest_ty.arrayLen(zcu); const src_len = src_ty.arrayLen(zcu); if (dest_len != src_len) { - return InMemoryCoercionResult{ .array_len = .{ + return .{ .array_len = .{ .actual = src_len, .wanted = dest_len, } }; @@ -31315,7 +31321,7 @@ pub fn coerceInMemoryAllowed( const src_elem_ty = src_ty.childType(zcu); const child = try sema.coerceInMemoryAllowed(block, dest_elem_ty, src_elem_ty, dest_is_mut, target, dest_src, src_src, null); if (child != .ok) { - return InMemoryCoercionResult{ .array_elem = .{ + return .{ .array_elem = .{ .child = try child.dupe(sema.arena), .actual = src_elem_ty, .wanted = dest_elem_ty, @@ -31325,7 +31331,7 @@ pub fn coerceInMemoryAllowed( if (dest_tag == .array) { const dest_info = dest_ty.arrayInfo(zcu); if (dest_info.sentinel != null) { - return InMemoryCoercionResult{ .array_sentinel = .{ + return .{ .array_sentinel = .{ .actual = Value.@"unreachable", .wanted = dest_info.sentinel.?, .ty = dest_info.elem_type, @@ -31345,7 +31351,7 @@ pub fn coerceInMemoryAllowed( // Optionals if (dest_tag == .optional and src_tag == .optional) { if ((maybe_dest_ptr_ty != null) != (maybe_src_ptr_ty != null)) { - return InMemoryCoercionResult{ .optional_shape = .{ + return .{ .optional_shape = .{ .actual = src_ty, .wanted = dest_ty, } }; @@ -31355,7 +31361,7 @@ pub fn coerceInMemoryAllowed( const child = try sema.coerceInMemoryAllowed(block, dest_child_type, src_child_type, dest_is_mut, target, dest_src, src_src, null); if (child != .ok) { - return InMemoryCoercionResult{ .optional_child = .{ + return .{ .optional_child = .{ .child = try child.dupe(sema.arena), .actual = src_child_type, .wanted = dest_child_type, @@ -31367,7 +31373,6 @@ pub fn coerceInMemoryAllowed( // Tuples (with in-memory-coercible fields) if (dest_ty.isTuple(zcu) and src_ty.isTuple(zcu)) tuple: { - if (dest_ty.containerLayout(zcu) != src_ty.containerLayout(zcu)) break :tuple; if (dest_ty.structFieldCount(zcu) != src_ty.structFieldCount(zcu)) break :tuple; const field_count = dest_ty.structFieldCount(zcu); for (0..field_count) |field_idx| { @@ -31381,7 +31386,7 @@ pub fn coerceInMemoryAllowed( return .ok; } - return InMemoryCoercionResult{ .no_match = .{ + return .{ .no_match = .{ .actual = dest_ty, .wanted = src_ty, } }; @@ -31490,6 +31495,8 @@ fn coerceInMemoryAllowedFns( block: *Block, dest_ty: Type, src_ty: Type, + /// If set, the coercion must be valid in both directions. + dest_is_mut: bool, target: std.Target, dest_src: LazySrcLoc, src_src: LazySrcLoc, @@ -31510,40 +31517,49 @@ fn coerceInMemoryAllowedFns( return InMemoryCoercionResult{ .fn_generic = dest_info.is_generic }; } - if (!callconvCoerceAllowed(target, src_info.cc, dest_info.cc)) { + const callconv_ok = callconvCoerceAllowed(target, src_info.cc, dest_info.cc) and + (!dest_is_mut or callconvCoerceAllowed(target, dest_info.cc, src_info.cc)); + + if (!callconv_ok) { return .{ .fn_cc = .{ .actual = src_info.cc, .wanted = dest_info.cc, } }; } - switch (src_info.return_type) { - .noreturn_type, .generic_poison_type => {}, - else => { - const dest_return_type = Type.fromInterned(dest_info.return_type); - const src_return_type = Type.fromInterned(src_info.return_type); - const rt = try sema.coerceInMemoryAllowed(block, dest_return_type, src_return_type, false, target, dest_src, src_src, null); - if (rt != .ok) { - return InMemoryCoercionResult{ .fn_return_type = .{ - .child = try rt.dupe(sema.arena), - .actual = src_return_type, - .wanted = dest_return_type, - } }; - } - }, + if (!switch (src_info.return_type) { + .generic_poison_type => true, + .noreturn_type => !dest_is_mut, + else => false, + }) { + const rt = try sema.coerceInMemoryAllowed( + block, + .fromInterned(dest_info.return_type), + .fromInterned(src_info.return_type), + dest_is_mut, + target, + dest_src, + src_src, + null, + ); + if (rt != .ok) return .{ .fn_return_type = .{ + .child = try rt.dupe(sema.arena), + .actual = .fromInterned(src_info.return_type), + .wanted = .fromInterned(dest_info.return_type), + } }; } } const params_len = params_len: { if (dest_info.param_types.len != src_info.param_types.len) { - return InMemoryCoercionResult{ .fn_param_count = .{ + return .{ .fn_param_count = .{ .actual = src_info.param_types.len, .wanted = dest_info.param_types.len, } }; } if (dest_info.noalias_bits != src_info.noalias_bits) { - return InMemoryCoercionResult{ .fn_param_noalias = .{ + return .{ .fn_param_noalias = .{ .actual = src_info.noalias_bits, .wanted = dest_info.noalias_bits, } }; @@ -31553,14 +31569,15 @@ fn coerceInMemoryAllowedFns( }; for (0..params_len) |param_i| { - const dest_param_ty = Type.fromInterned(dest_info.param_types.get(ip)[param_i]); - const src_param_ty = Type.fromInterned(src_info.param_types.get(ip)[param_i]); + const dest_param_ty: Type = .fromInterned(dest_info.param_types.get(ip)[param_i]); + const src_param_ty: Type = .fromInterned(src_info.param_types.get(ip)[param_i]); - const param_i_small: u5 = @intCast(param_i); - if (dest_info.paramIsComptime(param_i_small) != src_info.paramIsComptime(param_i_small)) { - return InMemoryCoercionResult{ .fn_param_comptime = .{ + const src_is_comptime = src_info.paramIsComptime(@intCast(param_i)); + const dest_is_comptime = dest_info.paramIsComptime(@intCast(param_i)); + if (src_is_comptime != dest_is_comptime) { + return .{ .fn_param_comptime = .{ .index = param_i, - .wanted = dest_info.paramIsComptime(param_i_small), + .wanted = dest_is_comptime, } }; } @@ -31568,9 +31585,9 @@ fn coerceInMemoryAllowedFns( .generic_poison_type => {}, else => { // Note: Cast direction is reversed here. - const param = try sema.coerceInMemoryAllowed(block, src_param_ty, dest_param_ty, false, target, dest_src, src_src, null); + const param = try sema.coerceInMemoryAllowed(block, src_param_ty, dest_param_ty, dest_is_mut, target, dest_src, src_src, null); if (param != .ok) { - return InMemoryCoercionResult{ .fn_param = .{ + return .{ .fn_param = .{ .child = try param.dupe(sema.arena), .actual = src_param_ty, .wanted = dest_param_ty, @@ -31629,6 +31646,7 @@ fn coerceInMemoryAllowedPtrs( src_ty: Type, dest_ptr_ty: Type, src_ptr_ty: Type, + /// If set, the coercion must be valid in both directions. dest_is_mut: bool, target: std.Target, dest_src: LazySrcLoc, @@ -31648,12 +31666,14 @@ fn coerceInMemoryAllowedPtrs( } }; } - const ok_cv_qualifiers = - (!src_info.flags.is_const or dest_info.flags.is_const) and - (!src_info.flags.is_volatile or dest_info.flags.is_volatile); + const ok_const = src_info.flags.is_const == dest_info.flags.is_const or + (!dest_is_mut and dest_info.flags.is_const); - if (!ok_cv_qualifiers) { - return InMemoryCoercionResult{ .ptr_qualifiers = .{ + const ok_volatile = src_info.flags.is_volatile == dest_info.flags.is_volatile or + (!dest_is_mut and dest_info.flags.is_volatile); + + if (!ok_const or !ok_volatile) { + return .{ .ptr_qualifiers = .{ .actual_const = src_info.flags.is_const, .wanted_const = dest_info.flags.is_const, .actual_volatile = src_info.flags.is_volatile, @@ -31662,7 +31682,7 @@ fn coerceInMemoryAllowedPtrs( } if (dest_info.flags.address_space != src_info.flags.address_space) { - return InMemoryCoercionResult{ .ptr_addrspace = .{ + return .{ .ptr_addrspace = .{ .actual = src_info.flags.address_space, .wanted = dest_info.flags.address_space, } }; @@ -31670,8 +31690,28 @@ fn coerceInMemoryAllowedPtrs( const dest_child = Type.fromInterned(dest_info.child); const src_child = Type.fromInterned(src_info.child); - const child = try sema.coerceInMemoryAllowed(block, dest_child, src_child, !dest_info.flags.is_const, target, dest_src, src_src, null); - if (child != .ok) allow: { + const child = try sema.coerceInMemoryAllowed( + block, + dest_child, + src_child, + // We must also include `dest_is_mut`. + // Otherwise, this code is valid: + // + // const b: B = ...; + // var pa: *const A = undefined; + // const ppa: **const A = &pa; + // const ppb: **const B = ppa; // <-- this is what that allows + // ppb.* = &b; + // const a: A = pa.*; + // + // ...effectively performing an in-memory coercion from B to A. + dest_is_mut or !dest_info.flags.is_const, + target, + dest_src, + src_src, + null, + ); + if (child != .ok and !dest_is_mut) allow: { // As a special case, we also allow coercing `*[n:s]T` to `*[n]T`, akin to dropping the sentinel from a slice. // `*[n:s]T` cannot coerce in memory to `*[n]T` since they have different sizes. if (src_child.zigTypeTag(zcu) == .array and dest_child.zigTypeTag(zcu) == .array and @@ -31680,21 +31720,21 @@ fn coerceInMemoryAllowedPtrs( { break :allow; } - return InMemoryCoercionResult{ .ptr_child = .{ + return .{ .ptr_child = .{ .child = try child.dupe(sema.arena), - .actual = Type.fromInterned(src_info.child), - .wanted = Type.fromInterned(dest_info.child), + .actual = .fromInterned(src_info.child), + .wanted = .fromInterned(dest_info.child), } }; } - const dest_allow_zero = dest_ty.ptrAllowsZero(zcu); - const src_allow_zero = src_ty.ptrAllowsZero(zcu); + const dest_allowzero = dest_ty.ptrAllowsZero(zcu); + const src_allowzero = src_ty.ptrAllowsZero(zcu); + + const ok_allowzero = src_allowzero == dest_allowzero or + (!dest_is_mut and dest_allowzero); - const ok_allows_zero = (dest_allow_zero and - (src_allow_zero or !dest_is_mut)) or - (!dest_allow_zero and !src_allow_zero); - if (!ok_allows_zero) { - return InMemoryCoercionResult{ .ptr_allowzero = .{ + if (!ok_allowzero) { + return .{ .ptr_allowzero = .{ .actual = src_ty, .wanted = dest_ty, } }; @@ -31703,7 +31743,7 @@ fn coerceInMemoryAllowedPtrs( if (src_info.packed_offset.host_size != dest_info.packed_offset.host_size or src_info.packed_offset.bit_offset != dest_info.packed_offset.bit_offset) { - return InMemoryCoercionResult{ .ptr_bit_range = .{ + return .{ .ptr_bit_range = .{ .actual_host = src_info.packed_offset.host_size, .wanted_host = dest_info.packed_offset.host_size, .actual_offset = src_info.packed_offset.bit_offset, @@ -31711,11 +31751,20 @@ fn coerceInMemoryAllowedPtrs( } }; } - const ok_sent = dest_info.sentinel == .none or src_info.flags.size == .C or - (src_info.sentinel != .none and - dest_info.sentinel == try zcu.intern_pool.getCoerced(sema.gpa, pt.tid, src_info.sentinel, dest_info.child)); - if (!ok_sent) { - return InMemoryCoercionResult{ .ptr_sentinel = .{ + const sentinel_ok = ok: { + const ss = src_info.sentinel; + const ds = dest_info.sentinel; + if (ss == .none and ds == .none) break :ok true; + if (ss != .none and ds != .none) { + if (ds == try zcu.intern_pool.getCoerced(sema.gpa, pt.tid, ss, dest_info.child)) break :ok true; + } + if (src_info.flags.size == .C) break :ok true; + if (!dest_is_mut and dest_info.sentinel == .none) break :ok true; + break :ok false; + }; + + if (!sentinel_ok) { + return .{ .ptr_sentinel = .{ .actual = switch (src_info.sentinel) { .none => Value.@"unreachable", else => Value.fromInterned(src_info.sentinel), @@ -31745,7 +31794,7 @@ fn coerceInMemoryAllowedPtrs( else try Type.fromInterned(dest_info.child).abiAlignmentSema(pt); - if (dest_align.compare(.gt, src_align)) { + if (dest_align.compare(if (dest_is_mut) .neq else .gt, src_align)) { return InMemoryCoercionResult{ .ptr_alignment = .{ .actual = src_align, .wanted = dest_align, @@ -35415,11 +35464,11 @@ fn resolvePeerTypesInner( .peer_idx_b = i, } }; // ty -> cur_ty - if (.ok == try sema.coerceInMemoryAllowedFns(block, cur_ty, ty, target, src, src)) { + if (.ok == try sema.coerceInMemoryAllowedFns(block, cur_ty, ty, false, target, src, src)) { continue; } // cur_ty -> ty - if (.ok == try sema.coerceInMemoryAllowedFns(block, ty, cur_ty, target, src, src)) { + if (.ok == try sema.coerceInMemoryAllowedFns(block, ty, cur_ty, false, target, src, src)) { opt_cur_ty = ty; continue; } diff --git a/test/cases/compile_errors/invalid_pointer_coercions.zig b/test/cases/compile_errors/invalid_pointer_coercions.zig new file mode 100644 index 000000000000..33ab73afd434 --- /dev/null +++ b/test/cases/compile_errors/invalid_pointer_coercions.zig @@ -0,0 +1,75 @@ +//! This file contains pointer coercions which are invalid because the element types are only +//! in-memory coercible *in one direction*. When casting a mutable pointer, the element type +//! must coerce in both directions for the pointer to coerce. Otherwise, you could do something +//! like this, where `A` coerces to `B` but not vice-versa: +//! +//! ``` +//! var x: A = undefined; +//! const p: *B = &x; // `*A` -> `*B` +//! p.* = some_b; +//! const some_b_as_a = x; +//! ``` + +export fn error_set_to_larger() void { + var x: error{Foo} = undefined; + _ = @as(*const error{ Foo, Bar }, &x); // this is ok + _ = @as(*error{ Foo, Bar }, &x); // compile error +} + +export fn error_set_to_anyerror() void { + var x: error{Foo} = undefined; + _ = @as(*const anyerror, &x); // this is ok + _ = @as(*anyerror, &x); // compile error +} + +export fn error_union_to_anyerror_union() void { + var x: error{Foo}!u32 = undefined; + _ = @as(*const anyerror!u32, &x); // this is ok + _ = @as(*anyerror!u32, &x); // compile error +} + +export fn ptr_to_const_ptr() void { + var x: *u32 = undefined; + _ = @as(*const *const u32, &x); // this is ok + _ = @as(**const u32, &x); // compile error +} + +export fn ptr_to_allowzero_ptr() void { + var x: *u32 = undefined; + _ = @as(*const *allowzero u32, &x); // this is ok + _ = @as(**allowzero u32, &x); // compile error +} + +export fn ptr_to_volatile_ptr() void { + var x: *u32 = undefined; + _ = @as(*const *volatile u32, &x); // this is ok + _ = @as(**volatile u32, &x); // compile error +} + +export fn ptr_to_underaligned_ptr() void { + var x: *u32 = undefined; + _ = @as(*const *align(1) u32, &x); // this is ok + _ = @as(**align(1) u32, &x); // compile error +} + +// error +// +// :16:33: error: expected type '*error{Foo,Bar}', found '*error{Foo}' +// :16:33: note: pointer type child 'error{Foo}' cannot cast into pointer type child 'error{Foo,Bar}' +// :16:33: note: 'error.Bar' not a member of destination error set +// :22:24: error: expected type '*anyerror', found '*error{Foo}' +// :22:24: note: pointer type child 'error{Foo}' cannot cast into pointer type child 'anyerror' +// :22:24: note: global error set cannot cast into a smaller set +// :28:28: error: expected type '*anyerror!u32', found '*error{Foo}!u32' +// :28:28: note: pointer type child 'error{Foo}!u32' cannot cast into pointer type child 'anyerror!u32' +// :28:28: note: global error set cannot cast into a smaller set +// :34:26: error: expected type '**const u32', found '**u32' +// :34:26: note: pointer type child '*u32' cannot cast into pointer type child '*const u32' +// :40:30: error: expected type '**allowzero u32', found '**u32' +// :40:30: note: pointer type child '*u32' cannot cast into pointer type child '*allowzero u32' +// :40:30: note: mutable '*u32' allows illegal null values stored to type '*allowzero u32' +// :46:29: error: expected type '**volatile u32', found '**u32' +// :46:29: note: pointer type child '*u32' cannot cast into pointer type child '*volatile u32' +// :52:29: error: expected type '**align(1) u32', found '**u32' +// :52:29: note: pointer type child '*u32' cannot cast into pointer type child '*align(1) u32' +// :52:29: note: pointer alignment '4' cannot cast into pointer alignment '1'