Skip to content

Distinguish null reference production from null pointer dereference in UB checks#158796

Merged
rust-bors[bot] merged 1 commit into
rust-lang:mainfrom
raushan728:issues/154044
Jul 7, 2026
Merged

Distinguish null reference production from null pointer dereference in UB checks#158796
rust-bors[bot] merged 1 commit into
rust-lang:mainfrom
raushan728:issues/154044

Conversation

@raushan728

@raushan728 raushan728 commented Jul 5, 2026 •
edited by rustbot
Loading

Copy link
Copy Markdown
Contributor

Closes #154044

This change distinguishes null reference production from actual null pointer dereferences in the UB checks.

Producing a reference from a null pointer (for example, &*ptr) is undefined behavior even if no memory is dereferenced. This change introduces a dedicated AssertKind::NullReferenceConstructed and runtime panic so these cases produce a more accurate diagnostic while preserving the existing panic for actual null pointer dereferences.

Summary

  • Add AssertKind::NullReferenceConstructed.
  • Emit it for null reference production in the MIR null check pass.
  • Add panic_null_reference_constructed and its lang item.
  • Keep NullPointerDereference for actual dereferences.
  • Update the affected UI tests.

@rustbot

rustbot commented Jul 5, 2026

Copy link
Copy Markdown
Collaborator

This PR changes rustc_public

cc @oli-obk, @celinval, @ouz-a, @makai410

Some changes occurred to MIR optimizations

cc @rust-lang/wg-mir-opt

This PR changes MIR

cc @oli-obk, @RalfJung, @JakobDegen, @vakaras

rustc_codegen_cranelift is developed in its own repository. If possible, consider making this change to rust-lang/rustc_codegen_cranelift instead.

cc @bjorn3

Some changes occurred to the CTFE machinery

cc @RalfJung, @oli-obk, @lcnr

@rustbot rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Jul 5, 2026
@rustbot

rustbot commented Jul 5, 2026

Copy link
Copy Markdown
Collaborator

mu001999 is not on the review rotation at the moment.
They may take a while to respond.

@rustbot

rustbot commented Jul 5, 2026

Copy link
Copy Markdown
Collaborator

Requested reviewer is already assigned to this pull request.

Please choose another assignee.

RalfJung
RalfJung reviewed Jul 5, 2026
View reviewed changes
Comment thread tests/ui/mir/null/borrowed_mut_null.rs Outdated
//@ run-crash
//@ compile-flags: -C debug-assertions
//@ error-pattern: null pointer dereference occurred
//@ error-pattern: null reference formed

@RalfJung RalfJung Jul 5, 2026 •
edited by rustbot
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"formed" is not a verb we use for this anywhere else I think. The reference calls it "producing" an invalid value, maybe use that?

View changes since the review

@raushan728 raushan728 Jul 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks! i'll update the message to use produced to exact match the terminology.

@raushan728 raushan728 Jul 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done!

@raushan728
Distinguish null reference production from null pointer dereference
1a98242 
Introduce a dedicated panic for null reference production to distinguish
producing a reference from a null pointer from an actual null pointer
dereference.

This emits a dedicated panic message for null reference production while
preserving the existing panic for actual dereferences.
@raushan728 raushan728 changed the title Distinguish null reference formation from null pointer dereference in UB checks Distinguish null reference production from null pointer dereference in UB checks Jul 5, 2026
@saethlin

saethlin commented Jul 6, 2026

Copy link
Copy Markdown
Member

r? saethlin
@bors r+

@rust-bors

rust-bors Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

📌 Commit 1a98242 has been approved by saethlin

It is now in the queue for this repository.

@rust-bors rust-bors Bot added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jul 6, 2026
@jhpratt jhpratt mentioned this pull request Jul 7, 2026
Merged
rust-bors Bot pushed a commit that referenced this pull request Jul 7, 2026
@bors
Auto merge of #158891 - jhpratt:rollup-ziqyJdz, r=jhpratt
bcd9ae8 
Rollup of 13 pull requests

Successful merges:

 - #158478 (Use correct typing mode in mir building for the next solver)
 - #158796 (Distinguish null reference production from null pointer dereference in UB checks)
 - #158821 (add regression test for late-bound type method probe ICE)
 - #158245 (Update the rustc_perf submodule)
 - #158346 (Prevent rustdoc auto-trait ICEs with `-Znext-solver=globally`)
 - #158536 (Instatiate binder instead of skipping when suggesting function arg error)
 - #158553 (Avoid infinite recursion when trying to build valtrees for self-referential consts)
 - #158679 (Document blocking guarantees for `std::sync`)
 - #158826 (Reorganize `tests/ui/issues` [19/N])
 - #158860 (Delete `impl_def_id` field from `ImplHeader`)
 - #158867 (rewrite `Align::max_for_target` in a more obvious way)
 - #158878 (borrowck: Inline `free_region_constraint_info()` to simplify the code)
 - #158881 (Update mdbook to 0.5.4)
@rust-bors
rust-bors Bot merged commit 91fc16b into rust-lang:main Jul 7, 2026
13 checks passed
@rustbot rustbot added this to the 1.99.0 milestone Jul 7, 2026
rust-timer added a commit that referenced this pull request Jul 7, 2026
@rust-timer
Unrolled build for #158796
3a5fcd8 
Rollup merge of #158796 - raushan728:issues/154044, r=saethlin

Distinguish null reference production from null pointer dereference in UB checks

Closes #154044

This change distinguishes null reference production from actual null pointer dereferences in the UB checks.

Producing a reference from a null pointer (for example, `&*ptr`) is undefined behavior even if no memory is dereferenced. This change introduces a dedicated `AssertKind::NullReferenceConstructed` and runtime panic so these cases produce a more accurate diagnostic while preserving the existing panic for actual null pointer dereferences.

Summary
- Add `AssertKind::NullReferenceConstructed`.
- Emit it for null reference production in the MIR null check pass.
- Add `panic_null_reference_constructed` and its lang item.
- Keep `NullPointerDereference` for actual dereferences.
- Update the affected UI tests.
@raushan728
raushan728 deleted the issues/154044 branch July 8, 2026 11:13
ojeda added a commit to Rust-for-Linux/linux that referenced this pull request Jul 11, 2026
@ojeda
objtool/rust: add one more noreturn Rust function for Rust 1.99.0
6ce2e7b 
Starting with Rust 1.99.0 (expected 2026-10-01), under
`CONFIG_RUST_DEBUG_ASSERTIONS=y`, `objtool` may report:

    rust/kernel.o: warning: objtool: _R..._6kernel12module_param9set_paramaEB4_()
    falls through to next function _R..._6kernel12module_param9set_paramhEB4_()

(and many others) due to calls to the `noreturn` symbol [1]:

    core::panicking::panic_null_reference_constructed

Thus add the mangled one to the list so that `objtool` knows it is
actually `noreturn`.

See commit 56d680d ("objtool/rust: list `noreturn` Rust functions")
for more details.

Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Petr Pavlu <petr.pavlu@suse.com>
Link: rust-lang/rust#158796 [1]
Reported-by: Alice Ryhl <aliceryhl@google.com>
Closes: https://lore.kernel.org/rust-for-linux/alEBInX9gD1M5NAr@google.com/
Link: https://patch.msgid.link/20260710173252.191781-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
ojeda added a commit to Rust-for-Linux/linux that referenced this pull request Jul 11, 2026
@ojeda
objtool/rust: add one more noreturn Rust function for Rust 1.99.0
5a81c35 
Starting with Rust 1.99.0 (expected 2026-10-01), under
`CONFIG_RUST_DEBUG_ASSERTIONS=y`, `objtool` may report:

    rust/kernel.o: warning: objtool: _R..._6kernel12module_param9set_paramaEB4_()
    falls through to next function _R..._6kernel12module_param9set_paramhEB4_()

(and many others) due to calls to the `noreturn` symbol [1]:

    core::panicking::panic_null_reference_constructed

Thus add the mangled one to the list so that `objtool` knows it is
actually `noreturn`.

See commit 56d680d ("objtool/rust: list `noreturn` Rust functions")
for more details.

Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Petr Pavlu <petr.pavlu@suse.com>
Link: rust-lang/rust#158796 [1]
Reported-by: Alice Ryhl <aliceryhl@google.com>
Closes: https://lore.kernel.org/rust-for-linux/alEBInX9gD1M5NAr@google.com/
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Tested-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260710173252.191781-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Kobzol pushed a commit to Kobzol/rustc_codegen_cranelift that referenced this pull request Jul 23, 2026
@bors
Auto merge of #158891 - jhpratt:rollup-ziqyJdz, r=jhpratt
59bd90e 
Rollup of 13 pull requests

Successful merges:

 - rust-lang/rust#158478 (Use correct typing mode in mir building for the next solver)
 - rust-lang/rust#158796 (Distinguish null reference production from null pointer dereference in UB checks)
 - rust-lang/rust#158821 (add regression test for late-bound type method probe ICE)
 - rust-lang/rust#158245 (Update the rustc_perf submodule)
 - rust-lang/rust#158346 (Prevent rustdoc auto-trait ICEs with `-Znext-solver=globally`)
 - rust-lang/rust#158536 (Instatiate binder instead of skipping when suggesting function arg error)
 - rust-lang/rust#158553 (Avoid infinite recursion when trying to build valtrees for self-referential consts)
 - rust-lang/rust#158679 (Document blocking guarantees for `std::sync`)
 - rust-lang/rust#158826 (Reorganize `tests/ui/issues` [19/N])
 - rust-lang/rust#158860 (Delete `impl_def_id` field from `ImplHeader`)
 - rust-lang/rust#158867 (rewrite `Align::max_for_target` in a more obvious way)
 - rust-lang/rust#158878 (borrowck: Inline `free_region_constraint_info()` to simplify the code)
 - rust-lang/rust#158881 (Update mdbook to 0.5.4)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@RalfJung RalfJung RalfJung left review comments

Assignees

@saethlin saethlin

Labels

S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. T-libs Relevant to the library team, which will review and decide on the PR/issue.

Projects

None yet

Milestone

1.99.0

Development

Successfully merging this pull request may close these issues.

Panic message for forming null reference in debug builds misleading

5 participants

@raushan728 @rustbot @saethlin @RalfJung @mu001999