3 ms·

My understanding is that there is a decent amount of undefined behavior on stack overflow in Rust, due to its use of TLS. https://github.com/rust-lang/rust/iss

My understanding is that there is a decent amount of undefined behavior on stack overflow in Rust, due to its use of TLS. https://github.com/rust-lang/rust/issues/43146 https://github.com/rust-lang/rust/issues/43146

kibwen 3y ago
I'm unclear how that would lead to undefined behavior on stack overflow. Stack overflow on Rust is specified to immediately abort the entire process (with some aforementioned wrinkles as to how achievable that is on certain targets), which necessarily nukes all TLS. The fact that the linked issue isn't tagged with "I-unsound" suggests that nobody has ever indicated that that might somehow be a soundness issue. If you think otherwise, I encourage you to bring it up so that any soundness issue can be properly tracked.
- swsieber 3y ago
  To push this point a little further: in Rust when there's not a clean way to prevent memory unsafety (or when you haven't requested to), it aborts the process. Out of array indexing, stack overflows, etc.
  - kibwen 3y ago
    Minor clarification: there's a difference between a "panic" (which may either unwind or abort, based on compilation flags) and a "guaranteed abort" (which is not negotiable). Array-index-out-of-bounds is merely a panic, as are almost all "unrecoverable errors" in Rust. Things that are guaranteed to abort are rare in Rust; I can only think of stack overflows, and OOM for certain stdlib types.
    - firstlink 3y ago
      Various refcount overflows also abort: mpmc, Arc, Rc: https://doc.rust-lang.org/src/alloc/rc.rs.html#2628 https://doc.rust-lang.org/src/alloc/rc.rs.html#2628 I think we're lucky the usual "aha rust isn't so safe after all, checkmate rustaceans!" crowd hasn't run into these aborts yet, because they won't have any kind of debugging spew so are not very friendly. You have to intentionally leak refcounts to hit these aborts or else you first run out of memory just storing the pointers; but then again, intentionally leaking things is just the sort of thing the anti-rust crowd is likely to try.
      - tialaramex 3y ago
        Mostly once they discover they can leak things, Rust is pronounced "not really safe" by such people anyway.
  - deleted 3y ago
    [deleted]
  - ridiculous_fish 3y ago
    My understanding is that the code which aborts the process contains the potential for UB.
    - kibwen 3y ago
      As far as I know, in the case of stack overflow, the code that aborts the process should literally just be a single line of assembly that contains an invalid opcode, resulting in a (safe) segfault. What has given you the impression that there is potential for UB in these code paths? EDIT: ah, I see your other comment.
- ridiculous_fish 3y ago
  Stack overflow in Rust does abort the process, but not immediately: the signal handler first distinguishes stack overflow from other sources of SIGSEGV/SIGBUS, and then prints a message containing the name of the current thread. Both of these require accessing TLS, which in turn may panic, or invoke other non-async-signal safe functions. That is UB. I don't know what the definition of a "soundness issue" is, but I think there are some nasal demons to be found here; it will be fun to try at least. edit the linked issue missed a case! Rust aborts by using libc::abort(), which is not async signal-safe in glibc prior to 2.26.
  - ridiculous_fish 3y ago
    I have put a bug report where my mouth is. https://github.com/rust-lang/rust/issues/111272 https://github.com/rust-lang/rust/issues/111272
    - kibwen 3y ago
      Thanks for the report! We can continue there. :)

kibwen 3y ago

I'm unclear how that would lead to undefined behavior on stack overflow. Stack overflow on Rust is specified to immediately abort the entire process (with some aforementioned wrinkles as to how achievable that is on certain targets), which necessarily nukes all TLS. The fact that the linked issue isn't tagged with "I-unsound" suggests that nobody has ever indicated that that might somehow be a soundness issue. If you think otherwise, I encourage you to bring it up so that any soundness issue can be properly tracked.

swsieber 3y ago
To push this point a little further: in Rust when there's not a clean way to prevent memory unsafety (or when you haven't requested to), it aborts the process. Out of array indexing, stack overflows, etc.
- kibwen 3y ago
  Minor clarification: there's a difference between a "panic" (which may either unwind or abort, based on compilation flags) and a "guaranteed abort" (which is not negotiable). Array-index-out-of-bounds is merely a panic, as are almost all "unrecoverable errors" in Rust. Things that are guaranteed to abort are rare in Rust; I can only think of stack overflows, and OOM for certain stdlib types.
  - firstlink 3y ago
    Various refcount overflows also abort: mpmc, Arc, Rc: https://doc.rust-lang.org/src/alloc/rc.rs.html#2628 https://doc.rust-lang.org/src/alloc/rc.rs.html#2628 I think we're lucky the usual "aha rust isn't so safe after all, checkmate rustaceans!" crowd hasn't run into these aborts yet, because they won't have any kind of debugging spew so are not very friendly. You have to intentionally leak refcounts to hit these aborts or else you first run out of memory just storing the pointers; but then again, intentionally leaking things is just the sort of thing the anti-rust crowd is likely to try.
    - tialaramex 3y ago
      Mostly once they discover they can leak things, Rust is pronounced "not really safe" by such people anyway.
- deleted 3y ago
  [deleted]
- ridiculous_fish 3y ago
  My understanding is that the code which aborts the process contains the potential for UB.
  - kibwen 3y ago
    As far as I know, in the case of stack overflow, the code that aborts the process should literally just be a single line of assembly that contains an invalid opcode, resulting in a (safe) segfault. What has given you the impression that there is potential for UB in these code paths? EDIT: ah, I see your other comment.
ridiculous_fish 3y ago
Stack overflow in Rust does abort the process, but not immediately: the signal handler first distinguishes stack overflow from other sources of SIGSEGV/SIGBUS, and then prints a message containing the name of the current thread. Both of these require accessing TLS, which in turn may panic, or invoke other non-async-signal safe functions. That is UB. I don't know what the definition of a "soundness issue" is, but I think there are some nasal demons to be found here; it will be fun to try at least. edit the linked issue missed a case! Rust aborts by using libc::abort(), which is not async signal-safe in glibc prior to 2.26.
- ridiculous_fish 3y ago
  I have put a bug report where my mouth is. https://github.com/rust-lang/rust/issues/111272 https://github.com/rust-lang/rust/issues/111272
  - kibwen 3y ago
    Thanks for the report! We can continue there. :)