std: simplify SGX's UnsafeList - #161060
Open
joboet wants to merge 1 commit into
Open
Conversation
rustbot
added
O-SGX
Collaborator
|
r? @clarfonthey rustbot has assigned @clarfonthey. Use Why was this reviewer chosen?The reviewer was selected based on:
|
Contributor
|
This is a very intrusive change that changes a lot about the inner workings of the list as well as the list API. I don't really support making this kind of change. |
Member
Author
|
Given that both |
Contributor
|
The problem is that this needs to be very carefully designed and reviewed because it can easily lead to fundamental concurrency issues if there are any bugs. I don't see a good reason for such an intrusive change given there are much simpler fixes. |
Contributor
|
I consider the pointer provenance laundering stuff to be a very complicated fix, so I don't think the "there are much simpler fixes" argument really holds. |
Contributor
|
The entire code can be reviewed and fully understood assuming launder is a no-op. |
Launder is a runtime no-op, but is very significant at compile time as any issues with it will lead to silent miscompilations. |
2 tasks
Contributor
rustbot
added
S-blocked
Contributor
|
Gonna also r? nia-e since she's working on that PR, and can decide whether to prefer this one instead long-term. |
Member
|
I ended up approving #161334 for the time being, since this is going to affect SGX only. I still want to land (something like) this in the future for bus factor reasons, but it's gonna be a more involved review as I need to familiarise myself with SGX internals a little. In the meantime, this is blocked on the above landing & then a rebase probably. @rustbot blocked |
JonathanBrouwer
added a commit
to JonathanBrouwer/rust
that referenced
this pull request
Sep 10, 2026
Fix soundness issues in std::sys::pal::sgx::waitqueue::unsafe_list Replace invalid uses of references in `std::sys::pal::sgx::waitqueue::unsafe_list` internals with raw pointers. I tried to keep the code structure the same as much as possible. In addition to the use of references flagged in the original issue, it turns out the head/tail (raw) pointer stored in the linked list caused provenance issues in miri. Switched to using UnsafePinned for that. PR organization: * Commit 1: Main soundness fix. * Commit 2: Use pinning in the `pub(crate)` API for UnsafeList. This code predates pinning in Rust. I believe this change isn't strictly necessary as I believe it's valid to document pinning requirements in the unsafe methods on UnsafeList. However, I felt it's better to be explicit about this now that pinning is available in the language. * Commit 3: Move UnsafeList to a platform-agnostic location so miri can be run on the test suite. This also adds some tests. This PR was developed with Claude Fable 5 through extensive interactive use, where I directed a detailed plan for making the changes needed for this fix. My input includes keeping the structure the same and the new internal abstraction for dealing with raw pointers. I'm not familiar with miri, I used Claude to test the changes with miri. It said the test suite was failing before the changes (both stacked borrows and tree borrows) but passing after. The additional tests developed this way have been added in the third commit. The head/tail pointer provenance issue was found with Claude. I thoroughly reviewed all the code, including comments, and made manual changes/deletions where necessary/appropriate. The PR description was written by me. r? @nia-e Fixes rust-lang#114581 Fixes rust-lang#160603 Fixes rust-lang#161060 Supersedes rust-lang#160641
JonathanBrouwer
added a commit
to JonathanBrouwer/rust
that referenced
this pull request
Sep 10, 2026
Fix soundness issues in std::sys::pal::sgx::waitqueue::unsafe_list Replace invalid uses of references in `std::sys::pal::sgx::waitqueue::unsafe_list` internals with raw pointers. I tried to keep the code structure the same as much as possible. In addition to the use of references flagged in the original issue, it turns out the head/tail (raw) pointer stored in the linked list caused provenance issues in miri. Switched to using UnsafePinned for that. PR organization: * Commit 1: Main soundness fix. * Commit 2: Use pinning in the `pub(crate)` API for UnsafeList. This code predates pinning in Rust. I believe this change isn't strictly necessary as I believe it's valid to document pinning requirements in the unsafe methods on UnsafeList. However, I felt it's better to be explicit about this now that pinning is available in the language. * Commit 3: Move UnsafeList to a platform-agnostic location so miri can be run on the test suite. This also adds some tests. This PR was developed with Claude Fable 5 through extensive interactive use, where I directed a detailed plan for making the changes needed for this fix. My input includes keeping the structure the same and the new internal abstraction for dealing with raw pointers. I'm not familiar with miri, I used Claude to test the changes with miri. It said the test suite was failing before the changes (both stacked borrows and tree borrows) but passing after. The additional tests developed this way have been added in the third commit. The head/tail pointer provenance issue was found with Claude. I thoroughly reviewed all the code, including comments, and made manual changes/deletions where necessary/appropriate. The PR description was written by me. r? @nia-e Fixes rust-lang#114581 Fixes rust-lang#160603 Fixes rust-lang#161060 Supersedes rust-lang#160641
rust-bors Bot
pushed a commit
that referenced
this pull request
Sep 10, 2026
Fix soundness issues in std::sys::pal::sgx::waitqueue::unsafe_list Replace invalid uses of references in `std::sys::pal::sgx::waitqueue::unsafe_list` internals with raw pointers. I tried to keep the code structure the same as much as possible. In addition to the use of references flagged in the original issue, it turns out the head/tail (raw) pointer stored in the linked list caused provenance issues in miri. Switched to using UnsafePinned for that. PR organization: * Commit 1: Main soundness fix. * Commit 2: Use pinning in the `pub(crate)` API for UnsafeList. This code predates pinning in Rust. I believe this change isn't strictly necessary as I believe it's valid to document pinning requirements in the unsafe methods on UnsafeList. However, I felt it's better to be explicit about this now that pinning is available in the language. * Commit 3: Move UnsafeList to a platform-agnostic location so miri can be run on the test suite. This also adds some tests. This PR was developed with Claude Fable 5 through extensive interactive use, where I directed a detailed plan for making the changes needed for this fix. My input includes keeping the structure the same and the new internal abstraction for dealing with raw pointers. I'm not familiar with miri, I used Claude to test the changes with miri. It said the test suite was failing before the changes (both stacked borrows and tree borrows) but passing after. The additional tests developed this way have been added in the third commit. The head/tail pointer provenance issue was found with Claude. I thoroughly reviewed all the code, including comments, and made manual changes/deletions where necessary/appropriate. The PR description was written by me. r? @nia-e Fixes #114581 Fixes #160603 Fixes #161060 Supersedes #160641
JonathanBrouwer
added a commit
to JonathanBrouwer/rust
that referenced
this pull request
Sep 10, 2026
Fix soundness issues in std::sys::pal::sgx::waitqueue::unsafe_list Replace invalid uses of references in `std::sys::pal::sgx::waitqueue::unsafe_list` internals with raw pointers. I tried to keep the code structure the same as much as possible. In addition to the use of references flagged in the original issue, it turns out the head/tail (raw) pointer stored in the linked list caused provenance issues in miri. Switched to using UnsafePinned for that. PR organization: * Commit 1: Main soundness fix. * Commit 2: Use pinning in the `pub(crate)` API for UnsafeList. This code predates pinning in Rust. I believe this change isn't strictly necessary as I believe it's valid to document pinning requirements in the unsafe methods on UnsafeList. However, I felt it's better to be explicit about this now that pinning is available in the language. * Commit 3: Move UnsafeList to a platform-agnostic location so miri can be run on the test suite. This also adds some tests. This PR was developed with Claude Fable 5 through extensive interactive use, where I directed a detailed plan for making the changes needed for this fix. My input includes keeping the structure the same and the new internal abstraction for dealing with raw pointers. I'm not familiar with miri, I used Claude to test the changes with miri. It said the test suite was failing before the changes (both stacked borrows and tree borrows) but passing after. The additional tests developed this way have been added in the third commit. The head/tail pointer provenance issue was found with Claude. I thoroughly reviewed all the code, including comments, and made manual changes/deletions where necessary/appropriate. The PR description was written by me. r? @nia-e Fixes rust-lang#114581 Fixes rust-lang#160603 Fixes rust-lang#161060 Supersedes rust-lang#160641
rust-bors Bot
pushed a commit
that referenced
this pull request
Sep 11, 2026
Rollup merge of #161334 - jethrogb:fix-sgx-unsafe-list, r=nia-e Fix soundness issues in std::sys::pal::sgx::waitqueue::unsafe_list Replace invalid uses of references in `std::sys::pal::sgx::waitqueue::unsafe_list` internals with raw pointers. I tried to keep the code structure the same as much as possible. In addition to the use of references flagged in the original issue, it turns out the head/tail (raw) pointer stored in the linked list caused provenance issues in miri. Switched to using UnsafePinned for that. PR organization: * Commit 1: Main soundness fix. * Commit 2: Use pinning in the `pub(crate)` API for UnsafeList. This code predates pinning in Rust. I believe this change isn't strictly necessary as I believe it's valid to document pinning requirements in the unsafe methods on UnsafeList. However, I felt it's better to be explicit about this now that pinning is available in the language. * Commit 3: Move UnsafeList to a platform-agnostic location so miri can be run on the test suite. This also adds some tests. This PR was developed with Claude Fable 5 through extensive interactive use, where I directed a detailed plan for making the changes needed for this fix. My input includes keeping the structure the same and the new internal abstraction for dealing with raw pointers. I'm not familiar with miri, I used Claude to test the changes with miri. It said the test suite was failing before the changes (both stacked borrows and tree borrows) but passing after. The additional tests developed this way have been added in the third commit. The head/tail pointer provenance issue was found with Claude. I thoroughly reviewed all the code, including comments, and made manual changes/deletions where necessary/appropriate. The PR description was written by me. r? @nia-e Fixes #114581 Fixes #160603 Fixes #161060 Supersedes #160641
rustbot
added
the
S-waiting-on-review
Collaborator
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #160603
Fixes #114581
This fixes the soundness issues in SGX's
UnsafeListby removing the use of a dummy node in the doubly-linked list, which would have required eitherUnsafePinnedor pointer laundering tricks to make sound (c.f. #160641). In addition, the code is now much more careful when it comes to creating mutable references to whole entries to avoid invalidating any shared borrows of the values when modifying lists.CC @jethrogb