Skip to content

test_vm_stdw_add_overflow encounters UB, will fail in Rust 1.83 #115

@saethlin

Description

@saethlin

I am filing this issue because this project's tests failed in a crater run for this PR: rust-lang/rust#130251 which should land in Rust 1.83.

The problem is that this crate can (under some conditions I do not understand but are encountered by test_vm_stdw_add_overflow) apply a negative offset to a null pointer via ptr::offset, which would cause the pointer to wrap around the address space. The standard library is getting a debug assertion for such wrapping offsets. If wrapping around the address space like that is deliberate, you should use wrapping_offset instead.

Miri can also detect this bug today:

╰ ➤ MIRIFLAGS=-Zmiri-permissive-provenance cargo +nightly miri test test_vm_stdw_add_overflow --test ubpf_vm
warning: no edition set: defaulting to the 2015 edition while the latest is 2021
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.02s
     Running tests/ubpf_vm.rs (target/miri/x86_64-unknown-linux-gnu/debug/deps/ubpf_vm-54926ca3f9d644be)

running 1 test
test test_vm_stdw_add_overflow - should panic ... error: Undefined Behavior: out-of-bounds pointer arithmetic: expected a pointer to the end of 1 byte of memory, but got a null pointer
    --> /tmp/rbpf-0.3.0/src/interpreter.rs:185:25
     |
185  |                 let x = (reg[_dst] as *const u8).offset(insn.off as isize) as *mut u64;
     |                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ out-of-bounds pointer arithmetic: expected a pointer to the end of 1 byte of memory, but got a null pointer

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions