Skip to content

Unexpected UB: retagging of variadic arguments #5058

@RalfJung

Description

@RalfJung

I would not expect this code to have UB:

#![feature(c_variadic)]
unsafe extern "C" fn write_through(
    ptr_to_val: *mut i32,
    hidden_mut_ref_to_val: ...
) {
    // UB: this write access invalidates a
    // protected mutable reference within
    // the list of variable arguments.
    unsafe { *ptr_to_val = 32; }
}

fn main() {
    let mut val: i32 = 0;
    let mut_ref_to_val = &mut val;
    let ptr_to_val = mut_ref_to_val as *mut _;
    unsafe {
        write_through(ptr_to_val, mut_ref_to_val);
    }
}

(Example by @icmccorm)

We end up retagging with a protector at that call based on caller-side type information. That shouldn't happen, the with-protector retagging is a callee operation and shouldn't use caller-side type information.

Cc @folkertdev

Metadata

Metadata

Assignees

No one assigned

    Labels

    A-aliasingArea: This affects the aliasing model (Stacked/Tree Borrows)C-bugCategory: This is a bug.I-false-UBImpact: makes Miri falsely report UB, i.e., a false positive (with default settings)

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions