Add mem_uninitialized lint to FCW on most usages

Author: 5225225

compiler/rustc_lint/src/builtin.rs

@@ -2591,6 +2591,204 @@ impl<'tcx> LateLintPass<'tcx> for InvalidValue {
     }
 }
 
+declare_lint! {
+    /// The `mem_uninitialized` lint detects all uses of `std::mem::uninitialized` that are not
+    /// known to be safe.
+    ///
+    /// This function is extremely dangerous, and nearly all uses of it cause immediate Undefined
+    /// Behavior.
+    ///
+    /// ### Example
+    ///
+    /// ```rust,compile_fail
+    /// #![deny(mem_uninitialized)]
+    /// fn main() {
+    ///     let x: [char; 16] = unsafe { std::mem::uninitialized() };
+    /// }
+    /// ```
+    ///
+    /// {{produces}}
+    ///
+    /// ### Explanation
+    ///
+    /// Creating an invalid value is undefined behavior, and nearly all types are invalid when left
+    /// uninitialized.
+    ///
+    /// To avoid churn, however, this will not lint for types made up entirely of integers, floats,
+    /// or raw pointers. This is not saying that leaving these types uninitialized is okay,
+    /// however.
+    pub MEM_UNINITIALIZED,
+    Warn,
+    "use of mem::uninitialized",
+    @future_incompatible = FutureIncompatibleInfo {
+        reference: "FIXME: fill this in",
+        reason: FutureIncompatibilityReason::FutureReleaseErrorReportNow,
+        explain_reason: false,
+    };
+}
+
+declare_lint_pass!(MemUninitialized => [MEM_UNINITIALIZED]);
+
+impl<'tcx> LateLintPass<'tcx> for MemUninitialized {
+    fn check_expr(&mut self, cx: &LateContext<'tcx>, expr: &hir::Expr<'_>) {
+        /// Information about why a type cannot be initialized this way.
+        /// Contains an error message and optionally a span to point at.
+        type InitError = (String, Option<Span>);
+
+        /// Determine if this expression is a "dangerous initialization".
+        fn is_dangerous_init(cx: &LateContext<'_>, expr: &hir::Expr<'_>) -> bool {
+            if let hir::ExprKind::Call(ref path_expr, _) = expr.kind {
+                // Find calls to `mem::{uninitialized,zeroed}` methods.
+                if let hir::ExprKind::Path(ref qpath) = path_expr.kind {
+                    if let Some(def_id) = cx.qpath_res(qpath, path_expr.hir_id).opt_def_id() {
+                        if cx.tcx.is_diagnostic_item(sym::mem_uninitialized, def_id) {
+                            return true;
+                        }
+                    }
+                }
+            }
+
+            false
+        }
+
+        /// Return `None` only if we are sure this type does
+        /// allow being left uninitialized.
+        fn ty_find_init_error<'tcx>(cx: &LateContext<'tcx>, ty: Ty<'tcx>) -> Option<InitError> {
+            use rustc_type_ir::sty::TyKind::*;
+            match ty.kind() {
+                // Primitive types that don't like 0 as a value.
+                Ref(..) => Some(("references must be non-null".to_string(), None)),
+                Adt(..) if ty.is_box() => Some(("`Box` must be non-null".to_string(), None)),
+                FnPtr(..) => Some(("function pointers must be non-null".to_string(), None)),
+                Never => Some(("the `!` type has no valid value".to_string(), None)),
+                RawPtr(tm) if matches!(tm.ty.kind(), Dynamic(..)) =>
+                // raw ptr to dyn Trait
+                {
+                    Some(("the vtable of a wide raw pointer must be non-null".to_string(), None))
+                }
+                // Primitive types with other constraints.
+                Bool => Some(("booleans must be either `true` or `false`".to_string(), None)),
+                Char => Some(("characters must be a valid Unicode codepoint".to_string(), None)),
+                Adt(adt_def, _) if adt_def.is_union() => None,
+                // Recurse and checks for some compound types.
+                Adt(adt_def, substs) => {
+                    // First check if this ADT has a layout attribute (like `NonNull` and friends).
+                    use std::ops::Bound;
+                    match cx.tcx.layout_scalar_valid_range(adt_def.did()) {
+                        // We exploit here that `layout_scalar_valid_range` will never
+                        // return `Bound::Excluded`.  (And we have tests checking that we
+                        // handle the attribute correctly.)
+                        (Bound::Included(lo), _) if lo > 0 => {
+                            return Some((format!("`{}` must be non-null", ty), None));
+                        }
+                        (Bound::Included(_), _) | (_, Bound::Included(_)) => {
+                            return Some((
+                                format!(
+                                    "`{}` must be initialized inside its custom valid range",
+                                    ty,
+                                ),
+                                None,
+                            ));
+                        }
+                        _ => {}
+                    }
+                    // Now, recurse.
+                    match adt_def.variants().len() {
+                        0 => Some(("enums with no variants have no valid value".to_string(), None)),
+                        1 => {
+                            // Struct, or enum with exactly one variant.
+                            // Proceed recursively, check all fields.
+                            let variant = &adt_def.variant(VariantIdx::from_u32(0));
+                            variant.fields.iter().find_map(|field| {
+                                ty_find_init_error(cx, field.ty(cx.tcx, substs)).map(
+                                    |(mut msg, span)| {
+                                        if span.is_none() {
+                                            // Point to this field, should be helpful for figuring
+                                            // out where the source of the error is.
+                                            let span = cx.tcx.def_span(field.did);
+                                            write!(
+                                                &mut msg,
+                                                " (in this {} field)",
+                                                adt_def.descr()
+                                            )
+                                            .unwrap();
+                                            (msg, Some(span))
+                                        } else {
+                                            // Just forward.
+                                            (msg, span)
+                                        }
+                                    },
+                                )
+                            })
+                        }
+                        // Multi-variant enum.
+                        _ => {
+                            // This will warn on something like Result<MaybeUninit<u32>, !> which
+                            // is not UB under the current enum layout, even ignoring the 0x01
+                            // filling.
+                            //
+                            // That's probably fine though.
+                            let span = cx.tcx.def_span(adt_def.did());
+                            Some((
+                                "enums have to be initialized to a variant".to_string(),
+                                Some(span),
+                            ))
+                        }
+                    }
+                }
+                Tuple(..) => {
+                    // Proceed recursively, check all fields.
+                    ty.tuple_fields().iter().find_map(|field| ty_find_init_error(cx, field))
+                }
+                Array(ty, len) => {
+                    match len.try_eval_usize(cx.tcx, cx.param_env) {
+                        // Array known to be zero sized, we can't warn.
+                        Some(0) => None,
+
+                        Some(_) | None => ty_find_init_error(cx, *ty),
+                    }
+                }
+                Int(_) | Uint(_) | Float(_) | RawPtr(_) => {
+                    // These are Plain Old Data types that people expect to work if they leave them
+                    // uninitialized.
+                    None
+                }
+                // Pessimistic fallback.
+                _ => Some(("type might not be allowed to be left uninitialized".to_string(), None)),
+            }
+        }
+
+        if is_dangerous_init(cx, expr) {
+            // This conjures an instance of a type out of nothing,
+            // using zeroed or uninitialized memory.
+            // We are extremely conservative with what we warn about.
+            let conjured_ty = cx.typeck_results().expr_ty(expr);
+            if let Some((msg, span)) = with_no_trimmed_paths!(ty_find_init_error(cx, conjured_ty)) {
+                // FIXME(davidtwco): make translatable
+                cx.struct_span_lint(MEM_UNINITIALIZED, expr.span, |lint| {
+                    let mut err = with_no_trimmed_paths!(lint.build(&format!(
+                        "the type `{}` does not definitely permit being left uninitialized",
+                        conjured_ty,
+                    )));
+
+                    err.span_label(expr.span, "this code causes undefined behavior when executed");
+                    err.span_label(
+                        expr.span,
+                        "help: use `MaybeUninit<T>` instead, \
+                            and only call `assume_init` after initialization is done",
+                    );
+                    if let Some(span) = span {
+                        err.span_note(span, &msg);
+                    } else {
+                        err.note(&msg);
+                    }
+                    err.emit();
+                });
+            }
+        }
+    }
+}
+
 declare_lint! {
     /// The `clashing_extern_declarations` lint detects when an `extern fn`
     /// has been declared with the same name but different types.

compiler/rustc_lint/src/lib.rs

@@ -211,6 +211,7 @@ macro_rules! late_lint_mod_passes {
                 UnreachablePub: UnreachablePub,
                 ExplicitOutlivesRequirements: ExplicitOutlivesRequirements,
                 InvalidValue: InvalidValue,
+                MemUninitialized: MemUninitialized,
                 DerefNullPtr: DerefNullPtr,
                 // May Depend on constants elsewhere
                 UnusedBrokenConst: UnusedBrokenConst,

library/core/src/mem/maybe_uninit.rs

@@ -33,6 +33,7 @@ use crate::slice;
 ///
 /// ```rust,no_run
 /// # #![allow(invalid_value)]
+/// # #![cfg_attr(not(bootstrap), allow(mem_uninitialized))]
 /// use std::mem::{self, MaybeUninit};
 ///
 /// let b: bool = unsafe { mem::uninitialized() }; // undefined behavior! ⚠️
@@ -48,6 +49,7 @@ use crate::slice;
 ///
 /// ```rust,no_run
 /// # #![allow(invalid_value)]
+/// # #![cfg_attr(not(bootstrap), allow(mem_uninitialized))]
 /// use std::mem::{self, MaybeUninit};
 ///
 /// let x: i32 = unsafe { mem::uninitialized() }; // undefined behavior! ⚠️

src/test/ui/const-generics/issues/issue-61422.rs

@@ -7,7 +7,7 @@ use std::mem;
 
 fn foo<const SIZE: usize>() {
     let arr: [u8; SIZE] = unsafe {
-        #[allow(deprecated)]
+        #[allow(deprecated, mem_uninitialized)]
         let array: [u8; SIZE] = mem::uninitialized();
         array
     };

src/test/ui/intrinsics/mem-uninitialized-future-compat.rs

@@ -0,0 +1,60 @@
+#![feature(never_type)]
+#![deny(mem_uninitialized)]
+#![allow(deprecated, invalid_value, dead_code)]
+
+use std::mem::MaybeUninit;
+
+struct UninitStruct {
+    a: u32,
+    b: char,
+}
+
+unsafe fn unknown_type<T, const N: usize>() {
+    std::mem::uninitialized::<T>();
+    //~^ ERROR the type `T` does not definitely permit being left uninitialized
+
+    std::mem::uninitialized::<[T; N]>();
+    //~^ ERROR the type `[T; N]` does not definitely permit being left uninitialized
+
+    std::mem::uninitialized::<[char; N]>();
+    //~^ ERROR the type `[char; N]` does not definitely permit being left uninitialized
+
+    std::mem::uninitialized::<[T; 0]>();
+    std::mem::uninitialized::<[char; 0]>();
+}
+
+fn main() {
+    unsafe {
+        std::mem::uninitialized::<&'static u32>();
+        //~^ ERROR the type `&u32` does not definitely permit being left uninitialized
+
+        std::mem::uninitialized::<Box<u32>>();
+        //~^ ERROR the type `std::boxed::Box<u32>` does not definitely permit being left uninitialized
+
+        std::mem::uninitialized::<fn()>();
+        //~^ ERROR the type `fn()` does not definitely permit being left uninitialized
+
+        std::mem::uninitialized::<!>();
+        //~^ ERROR the type `!` does not definitely permit being left uninitialized
+
+        std::mem::uninitialized::<*mut dyn std::io::Write>();
+        //~^ ERROR the type `*mut dyn std::io::Write` does not definitely permit being left uninitialized
+
+        std::mem::uninitialized::<bool>();
+        //~^ ERROR the type `bool` does not definitely permit being left uninitialized
+
+        std::mem::uninitialized::<char>();
+        //~^ ERROR the type `char` does not definitely permit being left uninitialized
+
+        std::mem::uninitialized::<UninitStruct>();
+        //~^ ERROR the type `UninitStruct` does not definitely permit being left uninitialized
+
+        std::mem::uninitialized::<(u32, char)>();
+        //~^ ERROR the type `(u32, char)` does not definitely permit being left uninitialized
+
+        std::mem::uninitialized::<MaybeUninit<Box<u32>>>();
+        std::mem::uninitialized::<usize>();
+        std::mem::uninitialized::<f32>();
+        std::mem::uninitialized::<*const u8>();
+    }
+}