|
| 1 | +use rustc_hir::{Block, Expr, ExprKind, HirId, LangItem}; |
| 2 | +use rustc_middle::ty::{Ty, TyCtxt}; |
| 3 | +use rustc_session::{declare_lint, impl_lint_pass}; |
| 4 | +use rustc_span::symbol::sym; |
| 5 | + |
| 6 | +use crate::lints::InstantlyDangling; |
| 7 | +use crate::{LateContext, LateLintPass, LintContext}; |
| 8 | + |
| 9 | +declare_lint! { |
| 10 | + /// The `dangling_pointers_from_temporaries` lint detects getting a pointer to data |
| 11 | + /// of a temporary that will immediately get dropped. |
| 12 | + /// |
| 13 | + /// ### Example |
| 14 | + /// |
| 15 | + /// ```rust |
| 16 | + /// # #![allow(unused)] |
| 17 | + /// # unsafe fn use_data(ptr: *const u8) { } |
| 18 | + /// fn gather_and_use(bytes: impl Iterator<Item = u8>) { |
| 19 | + /// let x: *const u8 = bytes.collect::<Vec<u8>>().as_ptr(); |
| 20 | + /// unsafe { use_data(x) } |
| 21 | + /// } |
| 22 | + /// ``` |
| 23 | + /// |
| 24 | + /// {{produces}} |
| 25 | + /// |
| 26 | + /// ### Explanation |
| 27 | + /// |
| 28 | + /// Getting a pointer from a temporary value will not prolong its lifetime, |
| 29 | + /// which means that the value can be dropped and the allocation freed |
| 30 | + /// while the pointer still exists, making the pointer dangling. |
| 31 | + /// This is not an error (as far as the type system is concerned) |
| 32 | + /// but probably is not what the user intended either. |
| 33 | + /// |
| 34 | + /// If you need stronger guarantees, consider using references instead, |
| 35 | + /// as they are statically verified by the borrow-checker to never dangle. |
| 36 | + pub DANGLING_POINTERS_FROM_TEMPORARIES, |
| 37 | + Warn, |
| 38 | + "detects getting a pointer from a temporary" |
| 39 | +} |
| 40 | + |
| 41 | +#[derive(Clone, Debug, PartialEq, Eq)] |
| 42 | +enum LifetimeExtension { |
| 43 | + /// Lifetime extension has not kicked in yet, but it will soon. |
| 44 | + /// Example: walking LHS of a function/method call. |
| 45 | + EnableLater { after_exit: HirId, until_exit: HirId }, |
| 46 | + /// Lifetime extension is currently active. |
| 47 | + /// Example: walking a function/method call's arguments. |
| 48 | + Enable { until_exit: HirId }, |
| 49 | + /// Temporary disable lifetime extension. |
| 50 | + /// Example: statements of a block that is a function/method call's argument. |
| 51 | + Disable { until_exit: HirId }, |
| 52 | +} |
| 53 | + |
| 54 | +#[derive(Clone, Default)] |
| 55 | +pub(crate) struct DanglingPointers { |
| 56 | + /// Trying to deal with argument lifetime extension. |
| 57 | + /// |
| 58 | + /// This produces a dangling pointer: |
| 59 | + /// ```ignore (example) |
| 60 | + /// let ptr = CString::new("hello").unwrap().as_ptr(); |
| 61 | + /// foo(ptr) |
| 62 | + /// ``` |
| 63 | + /// |
| 64 | + /// But this does not: |
| 65 | + /// ```ignore (example) |
| 66 | + /// foo(CString::new("hello").unwrap().as_ptr()) |
| 67 | + /// ``` |
| 68 | + /// |
| 69 | + /// But this does: |
| 70 | + /// ```ignore (example) |
| 71 | + /// foo({ let ptr = CString::new("hello").unwrap().as_ptr(); ptr }) |
| 72 | + /// ``` |
| 73 | + /// |
| 74 | + /// We have to deal with this situation somehow. |
| 75 | + /// |
| 76 | + /// If we were a visitor, we could just keep track of |
| 77 | + /// when we enter and exit places where lifetime extension kicks in |
| 78 | + /// during visiting/walking and update a boolean flag accordingly. |
| 79 | + /// |
| 80 | + /// But we are not a visitor. We are a LateLintPass. |
| 81 | + /// We are not the one who does the visiting & walking |
| 82 | + /// and can maintain this state directly in the call stack. |
| 83 | + /// But we do get called on every expression there is, |
| 84 | + /// both when entering it and exiting from it |
| 85 | + /// during our depth-first walk of the tree. |
| 86 | + /// So let's try to maintain this context stack explicitly |
| 87 | + /// instead of as a part of the call stack. |
| 88 | + nested_calls: Vec<LifetimeExtension>, |
| 89 | +} |
| 90 | + |
| 91 | +impl_lint_pass!(DanglingPointers => [DANGLING_POINTERS_FROM_TEMPORARIES]); |
| 92 | + |
| 93 | +/// FIXME: false negatives (i.e. the lint is not emitted when it should be) |
| 94 | +/// 1. Method calls that are not checked for: |
| 95 | +/// - [`temporary_unsafe_cell.get()`][`core::cell::UnsafeCell::get()`] |
| 96 | +/// - [`temporary_sync_unsafe_cell.get()`][`core::cell::SyncUnsafeCell::get()`] |
| 97 | +/// 2. Ways to get a temporary that are not recognized: |
| 98 | +/// - `owning_temporary.field` |
| 99 | +/// - `owning_temporary[index]` |
| 100 | +/// 3. No checks for ref-to-ptr conversions: |
| 101 | +/// - `&raw [mut] temporary` |
| 102 | +/// - `&temporary as *(const|mut) _` |
| 103 | +/// - `ptr::from_ref(&temporary)` and friends |
| 104 | +impl<'tcx> LateLintPass<'tcx> for DanglingPointers { |
| 105 | + fn check_expr(&mut self, cx: &LateContext<'tcx>, expr: &'tcx Expr<'_>) { |
| 106 | + if let Some(LifetimeExtension::Enable { .. }) = self.nested_calls.last() { |
| 107 | + match expr.kind { |
| 108 | + ExprKind::Block(Block { stmts: [.., last_stmt], .. }, _) => self |
| 109 | + .nested_calls |
| 110 | + .push(LifetimeExtension::Disable { until_exit: last_stmt.hir_id }), |
| 111 | + _ => { |
| 112 | + tracing::debug!(skip = ?cx.sess().source_map().span_to_snippet(expr.span)); |
| 113 | + return; |
| 114 | + } |
| 115 | + } |
| 116 | + } |
| 117 | + |
| 118 | + lint_expr(cx, expr); |
| 119 | + |
| 120 | + if let ExprKind::Call(lhs, _args) | ExprKind::MethodCall(_, lhs, _args, _) = expr.kind { |
| 121 | + self.nested_calls.push(LifetimeExtension::EnableLater { |
| 122 | + after_exit: lhs.hir_id, |
| 123 | + until_exit: expr.hir_id, |
| 124 | + }) |
| 125 | + } |
| 126 | + } |
| 127 | + |
| 128 | + fn check_expr_post(&mut self, _: &LateContext<'tcx>, expr: &'tcx Expr<'_>) { |
| 129 | + self.nested_calls.pop_if(|pos| match pos { |
| 130 | + LifetimeExtension::Enable { until_exit } |
| 131 | + | LifetimeExtension::Disable { until_exit } => expr.hir_id == *until_exit, |
| 132 | + |
| 133 | + &mut LifetimeExtension::EnableLater { after_exit, until_exit } => { |
| 134 | + if expr.hir_id == after_exit { |
| 135 | + *pos = LifetimeExtension::Enable { until_exit }; |
| 136 | + }; |
| 137 | + false |
| 138 | + } |
| 139 | + }); |
| 140 | + } |
| 141 | +} |
| 142 | + |
| 143 | +fn lint_expr(cx: &LateContext<'_>, expr: &Expr<'_>) { |
| 144 | + if let ExprKind::MethodCall(method, receiver, _args, _span) = expr.kind |
| 145 | + && matches!(method.ident.name, sym::as_ptr | sym::as_mut_ptr) |
| 146 | + && is_temporary_rvalue(receiver) |
| 147 | + && let ty = cx.typeck_results().expr_ty(receiver) |
| 148 | + && is_interesting(cx.tcx, ty) |
| 149 | + { |
| 150 | + cx.emit_span_lint( |
| 151 | + DANGLING_POINTERS_FROM_TEMPORARIES, |
| 152 | + method.ident.span, |
| 153 | + InstantlyDangling { |
| 154 | + callee: method.ident.name, |
| 155 | + ty, |
| 156 | + ptr_span: method.ident.span, |
| 157 | + temporary_span: receiver.span, |
| 158 | + }, |
| 159 | + ) |
| 160 | + } |
| 161 | +} |
| 162 | + |
| 163 | +fn is_temporary_rvalue(expr: &Expr<'_>) -> bool { |
| 164 | + match expr.kind { |
| 165 | + // Const is not temporary. |
| 166 | + ExprKind::ConstBlock(..) | ExprKind::Repeat(..) | ExprKind::Lit(..) => false, |
| 167 | + |
| 168 | + // This is literally lvalue. |
| 169 | + ExprKind::Path(..) => false, |
| 170 | + |
| 171 | + // Calls return rvalues. |
| 172 | + ExprKind::Call(..) | ExprKind::MethodCall(..) | ExprKind::Binary(..) => true, |
| 173 | + |
| 174 | + // Inner blocks are rvalues. |
| 175 | + ExprKind::If(..) | ExprKind::Loop(..) | ExprKind::Match(..) | ExprKind::Block(..) => true, |
| 176 | + |
| 177 | + // FIXME: these should probably recurse and typecheck along the way. |
| 178 | + // Some false negatives are possible for now. |
| 179 | + ExprKind::Index(..) | ExprKind::Field(..) | ExprKind::Unary(..) => false, |
| 180 | + |
| 181 | + ExprKind::Struct(..) => true, |
| 182 | + |
| 183 | + // FIXME: this has false negatives, but I do not want to deal with 'static/const promotion just yet. |
| 184 | + ExprKind::Array(..) => false, |
| 185 | + |
| 186 | + // These typecheck to `!` |
| 187 | + ExprKind::Break(..) | ExprKind::Continue(..) | ExprKind::Ret(..) | ExprKind::Become(..) => { |
| 188 | + false |
| 189 | + } |
| 190 | + |
| 191 | + // These typecheck to `()` |
| 192 | + ExprKind::Assign(..) | ExprKind::AssignOp(..) | ExprKind::Yield(..) => false, |
| 193 | + |
| 194 | + // Compiler-magic macros |
| 195 | + ExprKind::AddrOf(..) | ExprKind::OffsetOf(..) | ExprKind::InlineAsm(..) => false, |
| 196 | + |
| 197 | + // We are not interested in these |
| 198 | + ExprKind::Cast(..) |
| 199 | + | ExprKind::Closure(..) |
| 200 | + | ExprKind::Tup(..) |
| 201 | + | ExprKind::DropTemps(..) |
| 202 | + | ExprKind::Let(..) => false, |
| 203 | + |
| 204 | + // Not applicable |
| 205 | + ExprKind::Type(..) | ExprKind::Err(..) => false, |
| 206 | + } |
| 207 | +} |
| 208 | + |
| 209 | +// Array, Vec, String, CString, MaybeUninit, Cell, Box<[_]>, Box<str>, Box<CStr>, |
| 210 | +// or any of the above in arbitrary many nested Box'es. |
| 211 | +fn is_interesting(tcx: TyCtxt<'_>, ty: Ty<'_>) -> bool { |
| 212 | + if ty.is_array() { |
| 213 | + true |
| 214 | + } else if let Some(inner) = ty.boxed_ty() { |
| 215 | + inner.is_slice() |
| 216 | + || inner.is_str() |
| 217 | + || inner.ty_adt_def().is_some_and(|def| tcx.is_lang_item(def.did(), LangItem::CStr)) |
| 218 | + || is_interesting(tcx, inner) |
| 219 | + } else if let Some(def) = ty.ty_adt_def() { |
| 220 | + for lang_item in [LangItem::String, LangItem::MaybeUninit] { |
| 221 | + if tcx.is_lang_item(def.did(), lang_item) { |
| 222 | + return true; |
| 223 | + } |
| 224 | + } |
| 225 | + tcx.get_diagnostic_name(def.did()) |
| 226 | + .is_some_and(|name| matches!(name, sym::cstring_type | sym::Vec | sym::Cell)) |
| 227 | + } else { |
| 228 | + false |
| 229 | + } |
| 230 | +} |
0 commit comments