Skip to content

UB found using rustlantis #689

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
FractalFir opened this issue May 29, 2025 · 3 comments
Open

UB found using rustlantis #689

FractalFir opened this issue May 29, 2025 · 3 comments
Labels
bug Something isn't working

Comments

@FractalFir
Copy link
Contributor

FractalFir commented May 29, 2025

This Rust program (which runs fine under MIRI) produces different results in GCC debug mode(result same as LLVM) and GCC release mode(incorrect result).

The sample is currently ~140 LOC, I am working on reducing it further.

#![recursion_limit = "1024"]
#![feature(custom_mir, core_intrinsics, lazy_get)]
#![allow(unused_parens, unused_assignments, overflowing_literals)]
extern crate core;
use core::intrinsics::mir::*;
use std::fmt::Debug;
#[inline(never)]
fn dump_var(
    f: usize,
    var0: usize,
    val0: impl Debug,
    var1: usize,
    val1: impl Debug,
    var2: usize,
    val2: impl Debug,
    var3: usize,
    val3: impl Debug,
) {
    println!(
        "fn{f}:_{var0} = {val0:?}\n_{var1} = {val1:?}\n_{var2} = {val2:?}\n_{var3} = {val3:?}"
    );
}
pub fn fn2(
    mut _1: *mut isize,
    mut _2: i16,
    mut _3: i32,
    mut _4: u32,
    mut _5: u32,
    mut _6: isize,
    mut _7: i8,
    mut _8: isize,
    mut _9: u32,
    mut _10: bool,
) -> isize {
    let mut RET: isize = Default::default();
    let mut _11: u16 = Default::default();
    let mut _12: (f32, (), u64) = Default::default();
    let mut _15: u64 = Default::default();
    let mut _16: f64 = Default::default();
    let mut _17: (Adt38, *mut i8, f32, u16) = (Default::default(), core::ptr::null_mut(), 0.0, 0);
    let mut _33: () = Default::default();
    _4 = !_9;
    _1 = core::ptr::addr_of_mut!(_8);
    _9 = _4;
    _11 = 50919;
    RET = !_8;
    _10 = false;
    _4 = _5;
    _12.0 = 0.0;
    _7 = (-5965270870520108484_i64) as i8;
    loop {
        _12.2 = (-164714684559875379919518575010379717139_i128) as u64;
        unsafe {
            _17.2 = 0.0;
            _17.0.fld0 = _10;
            _17.3 = !_11;
            (*_1) = -RET;
            _1 = core::ptr::addr_of_mut!(_6);
            _4 = !_9;
            _17.1 = core::ptr::addr_of_mut!(_7);
            _15 = _12.2 << _8;
            _16 = (-3256106608463376368_i64) as f64;
            _8 = RET >> _3;
            match _5 {
                0 => {
                    _9 = _4;
                    (*_1) = _6;
                    _11 = '\u{bc6e7}' as u16;
                    RET = !(*_1);
                    (*_1) = -RET;
                    _10 = false;
                    (*_1) = _6 | RET;
                    _12.2 = (-164714684559875379919518575010379717139_i128) as u64;
                    continue;
                }
                1705677637 => {
                    (*_1) = 1;
                    (*_1) = 0;
                    _17.2 = _12.0 + _12.0;
                    _12.0 = _17.2 * _17.2;
                    _3 = (-2040533717_i32) | 1920924768_i32;
                    _11 = _17.3;
                    _1 = core::ptr::addr_of_mut!(_6);
                    _17.0.fld1 = _11 as u8;
                    _6 = _8;
                    _6 = 112574652318580291556652859739937967926_i128 as isize;
                    _6 = !_8;
                    _6 = _8;
                    _6 = _8 << _17.0.fld1;
                    _6 = _8 + RET;
                    _6 = fn3(_17.0, (_17));
                }
                _ => return RET,
            }
        };
        _4 = _5;
        _5 = _5 & _9;
        _9 = _5 & _9;
        _17.0.fld0 = !_10;
        _17.2 = 0.0;
        _17.1 = core::ptr::addr_of_mut!(_7);
        _3 = core::hint::black_box(-1922871724_i32) * 995968542_i32;
        _17.2 = _11 as f32;
        match _4 {
            1705677637 => return RET,
            _ => continue,
        }
    }
}
#[inline(never)]
pub fn fn3(mut arg1: Adt38, mut arg2: (Adt38, *mut i8, f32, u16)) -> isize {
    let mut tmp: (i64, i8) = Default::default();
    let _33 = !(arg1.fld1) as isize;
    arg2.1 = core::ptr::addr_of_mut!(tmp.1);
    dump_var(3_usize, 44_usize, (), 44_usize, (), 33_usize, (_33), 44_usize, ());
    return 1;
}
pub fn main() {
    let mut _13 = '\u{9f647}' as isize;
    let _1 = core::ptr::addr_of_mut!(_13);
    let a = true;
    let _2 = '\u{f2e32}' as i16;
    let _3 = 1705677637_u32;
    let _11 = !(-69_isize);
    let _6 = (-579835010_i32) & (-913890743_i32);
    let _4 = _2 as i8;
    println!("{:?}", _11);
    fn2(_1, _2, _6, _3, _3, _11, _4, _11, _3, a);
}
#[derive(Debug, Copy, Clone, Default)]
pub struct Adt38 {
    fld0: bool,
    fld1: u8,
}

Some interesting observations: it seems like the problem is related to pointers, and the control flow is different in release GCC(a "decoy" block gets executed, while it should never be).

@antoyo antoyo added the bug Something isn't working label May 29, 2025
@FractalFir
Copy link
Contributor Author

Managed to reproduce the issue in surface-level unsafe Rust(as opposed to MIR generated by rustlantis).

Now, I will try to reproduce it in safe Rust.

@FractalFir
Copy link
Contributor Author

FractalFir commented May 29, 2025

Reproducer in fully safe rust:

use std::fmt::Debug;
#[inline(never)]
fn dump_var(f: usize, var2: usize, val2: impl Debug) {
    println!("fn{f}:_{var2} = {val2:?}");
}
pub fn fn2(
    mut _2: i16,
    mut _3: i32,
    mut _4: u32,
    mut _5: u32,
    mut _6: isize,
    mut _8: isize,
    mut _9: u32,
    mut _10: bool,
) -> isize {
    let mut RET: isize = Default::default();
    let mut _11: u16 = Default::default();
    let mut _12: (f32, (), u64) = Default::default();
    let mut _15: u64 = Default::default();
    let mut _16: f64 = Default::default();
    let mut _17: (Adt38, u64, f32, u16) = (Default::default(), 0, 0.0, 0);
    _4 = !_9;
    RET = _8;
    let mut _1 = &mut _8;
    _9 = _4;
    _11 = 50919;
    _10 = false;
    _4 = _5;
    _12.0 = 0.0;
    _1 = &mut _6;
    loop {
        _12.2 = (-164714684559875379919518575010379717139_i128) as u64;
        _17.2 = 0.0;
        let tmp = _10;
        _17.3 = !_11;
        _4 = !_9;
        _15 = _12.2 << _8;
        _16 = (-3256106608463376368_i64) as f64;
        _8 = RET >> _3;
        match _5 {
            0 => return RET,
            1705677637 => {
                (*_1) = 1;
                (*_1) = 0;
                _11 = _17.3;
                _1 = &mut _6;
                _17.0.fld1 = _11 as u8;
                fn3(_17.0, (_17));
            }
            _ => return RET,
        }
        let tmp = !_10;
        _17.2 = 0.0;
        _3 = core::hint::black_box(1) * 942_i32;
        _17.2 = _11 as f32;
        _4 = _5;
        _5 = _5 & _9;
        match _4 {
            1705677637 => return RET,
            _ => continue,
        }
    }
}
#[inline(never)]
pub fn fn3(mut arg1: Adt38, mut arg2: (Adt38, u64, f32, u16)) -> isize {
    let _33 = !(arg1.fld1) as isize;
    dump_var(3_usize, 33_usize, (_33));
    return 1;
}
pub fn main() {
    let mut _13 = '\u{9f647}' as isize;
    let _1 = &mut _13;
    let a = true;
    let _2 = '\u{f2e32}' as i16;
    let _3 = 1705677637_u32;
    let _11 = !(-69_isize);
    let _6 = (-579835010_i32) & (-913890743_i32);
    let _4 = _2 as i8;
    println!("{:?}", _11);
    fn2(_2, _6, _3, _3, _11, _11, _3, a);
}
#[derive(Debug, Copy, Clone, Default)]
pub struct Adt38 {
    fld0: bool,
    fld1: u8,
}

It seems like I was wrong about the decoy blocks: they don't get executed, but are still needed to confuse GCC.

@FractalFir
Copy link
Contributor Author

FractalFir commented May 30, 2025

Reduced the issue down to 50 LOC, with only repr(C) types, and no pointers / references.

use std::fmt::Debug;
#[inline(never)]
fn dump_var(f: usize, var2: usize, val2: impl Debug) {
    println!("fn{f}:_{var2} = {val2:?}");
}
pub fn fn2(mut arg: u8) -> isize {
    let mut mut_int = 0;
    let mut adt1: Adt1 = Default::default();
    loop {
        let mut tmp = !mut_int;
        match arg {
            0 => return 0,
            1 => {
                mut_int = 1;
                adt1.a.fld1 = tmp as u8;
                fn3(adt1.a, adt1);
            }
            _ => return 0,
        }
        // Needed to prevent an ealier opt pass from seeing arg does not change(?).
        core::hint::black_box(());
        arg = arg & arg;
        match arg {
            1 => return 0,
            _ => continue,
        }
    }
}
#[inline(never)]
pub fn fn3(arg1: Adt38, arg2: Adt1) {
    dump_var(3_usize, 33_usize, (!(arg1.fld1) as isize));
}
pub fn main() {
    fn2(1);
}
#[derive(Debug, Copy, Clone, Default)]
#[repr(C)]
struct Adt1 {
    a: Adt38,
    unused: [u8; 2],
}
#[derive(Debug, Copy, Clone, Default)]
#[repr(C)]
pub struct Adt38 {
    fld0: u8,
    fld1: u8,
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants