Skip to content

add overlap check when copying op #97639

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

add overlap check when copying op #97639

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2668b2a
add overlap check when copying an imm
SparrowLii Jun 2, 2022
03509a6
correct overlap check
SparrowLii Jun 2, 2022
42c58cd
correct condition statement
SparrowLii Jun 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 23 additions & 14 deletions compiler/rustc_const_eval/src/interpret/memory.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1096,23 +1096,18 @@ impl<'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> InterpCx<'mir, 'tcx, M> {
// The pointers above remain valid even if the `HashMap` table is moved around because they
// point into the `Vec` storing the bytes.
unsafe {
if src_alloc_id == dest_alloc_id {
if Self::check_ptr_overlap(src_alloc_id, src_offset, dest_alloc_id, dest_offset, size) {
if nonoverlapping {
// `Size` additions
if (src_offset <= dest_offset && src_offset + size > dest_offset)
|| (dest_offset <= src_offset && dest_offset + size > src_offset)
{
throw_ub_format!("copy_nonoverlapping called on overlapping ranges")
throw_ub_format!("copy_nonoverlapping called on overlapping ranges")
} else {
for i in 0..num_copies {
ptr::copy(
src_bytes,
dest_bytes.add((size * i).bytes_usize()), // `Size` multiplication
size.bytes_usize(),
);
}
}

for i in 0..num_copies {
ptr::copy(
src_bytes,
dest_bytes.add((size * i).bytes_usize()), // `Size` multiplication
size.bytes_usize(),
);
}
} else {
for i in 0..num_copies {
ptr::copy_nonoverlapping(
Expand Down Expand Up @@ -1211,4 +1206,18 @@ impl<'mir, 'tcx: 'mir, M: Machine<'mir, 'tcx>> InterpCx<'mir, 'tcx, M> {
err_ub!(DanglingIntPointer(offset, CheckInAllocMsg::InboundsTest)).into()
})
}

/// Check if a `src` ptr overlaps with a `dest` ptr.
#[inline(always)]
pub fn check_ptr_overlap(
src_id: AllocId,
src_offset: Size,
dest_id: AllocId,
dest_offset: Size,
size: Size,
) -> bool {
let overlaps = |a, b| a <= b && b - a < size;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a comment explaining why the subtraction cannot overflow.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we could rewrite this as a.checked_sub(b).map_or(false, |s| s < size)

Copy link
Member

@RalfJung RalfJung Jun 2, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if that makes it any clearer; why is false the right default?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I think we can just comment that since `a <= b`, `b - a` will not overflows

src_id == dest_id
&& (overlaps(src_offset, dest_offset) || overlaps(dest_offset, src_offset))
}
}
14 changes: 12 additions & 2 deletions compiler/rustc_const_eval/src/interpret/place.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

use std::convert::TryFrom;
use std::hash::Hash;
use std::ops::Deref;

use rustc_ast::Mutability;
use rustc_macros::HashStable;
Expand Down Expand Up @@ -869,8 +870,17 @@ where
Ok(src_val) => {
assert!(!src.layout.is_unsized(), "cannot have unsized immediates");
// Yay, we got a value that we can write directly.
// FIXME: Add a check to make sure that if `src` is indirect,
// it does not overlap with `dest`.
// Then make sure `src` does not overlap with `dest`.
if let Operand::Indirect(src_mplace) = src.deref()
&& let Place::Ptr(dest_mplace) = dest.deref()
&& let Ok((src_id, src_offset, _)) = self.ptr_try_get_alloc_id(src_mplace.ptr)
&& let Ok((dest_id, dest_offset, _)) = self.ptr_try_get_alloc_id(dest_mplace.ptr)
{
let size = src_val.layout.size;
if Self::check_ptr_overlap(src_id, src_offset, dest_id, dest_offset, size) {
throw_ub_format!("copy_nonoverlapping called on overlapping ranges")
Copy link
Member

@RalfJung RalfJung Jun 2, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not the copy_nonoverlapping intrinsic, this is the assignment operator.

Also, that condition up there is enormously complicated and looks like it just unwraps all abstractions to get out some deep implementation detail. What is actually conceptually happening here, at a high level?

Copy link
Member

@RalfJung RalfJung Jun 2, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the right way to fix this FIXME is what we are discussing in #68364: by using retagging and aliasing restrictions. I don't think digging through all abstractions here is a good way to guarantee anything, since it is basically impossible to figure out what is being guaranteed. It is way too easy for any of these conditions to not be met, and then we gain nothing.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, I think we shouldn't do this part of the PR. Sorry for the misleading FIXME. Generally many of the FIXME in the code are old and our thinking might have changed since the comment was written -- so it is a good idea to ask people what their current thoughts on this are before working on a FIXME.

Here, I think the comment should just be changed to explicitly reference #68364.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's all right. Thanks!

}
}
return self.write_immediate_no_validate(*src_val, dest);
}
Err(mplace) => mplace,
Expand Down