Skip to content

[strict provenance] make the compiler's tagged_ptr stuff conform #95493

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Gankra opened this issue Mar 30, 2022 · 6 comments
Closed

[strict provenance] make the compiler's tagged_ptr stuff conform #95493

Gankra opened this issue Mar 30, 2022 · 6 comments
Labels
A-strict-provenance Area: Strict provenance for raw pointers T-compiler Relevant to the compiler team, which will review and decide on the PR/issue.

Comments

@Gankra
Copy link
Contributor

Gankra commented Mar 30, 2022

This issue is part of the Strict Provenance Experiment - #95228

tagged_ptr and everything that uses it is entirely provenance crimes

fn into_usize(self) -> usize;
/// # Safety
///
/// The passed `ptr` must be returned from `into_usize`.
///
/// This acts as `ptr::read` semantically, it should not be called more than
/// once on non-`Copy` `Pointer`s.
unsafe fn from_usize(ptr: usize) -> Self;

This is the precise point in updating std+compiler to conform to strict-provenance that I ran out of energy and just started marking the compiler as WONTFIX for the MVP. I believe @eddyb started working on this, but got a bit sidetracked because they ran into the fact that we're shifting pointers down so that we can high-bit-tag instead of low-bit-tag, and while this isn't per-se a problem for strict-provenance, it wasn't obviously portable to CHERI, which sucks.

Since then it's been clarified that e.g. Morello (CHERI on ARM) actually has allowances for high-bit tagging and pointer shifting, so it's possible that the code can just be changed to properly use pointers and with_addr and friends.

@Gankra Gankra added T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. A-strict-provenance Area: Strict provenance for raw pointers labels Mar 30, 2022
@HKalbasi
Copy link
Member

Fixed by #110243 ?

@RalfJung
Copy link
Member

Yes seems like it. :)

@WaffleLapkin do you know other places in the compiler that are still using "fuzzy provenance casts"?

@WaffleLapkin
Copy link
Member

@RalfJung There are still

ptr: NonZeroUsize,

I swear I was meaning to fix them... Maybe I forgot to open a PR? Will try to dig for it/write a new one.

Either way besides those two I don't remember and can't find any int2ptr casts in the compiler. Closing this as fixed by #110243.

@RalfJung
Copy link
Member

@WaffleLapkin are we tracking those last two somewhere?

@WaffleLapkin
Copy link
Member

@RalfJung not to my knowledge, I can open an issue though

@WaffleLapkin
Copy link
Member

For the record I've opened #119217

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-strict-provenance Area: Strict provenance for raw pointers T-compiler Relevant to the compiler team, which will review and decide on the PR/issue.
Projects
None yet
Development

No branches or pull requests

4 participants