Skip to content

cfi: add diag mode support - #157669

Merged
rust-bors[bot] merged 2 commits into
rust-lang:mainfrom
1c3t3a:cfi-diag-mode
Jul 30, 2026
Merged

cfi: add diag mode support#157669
rust-bors[bot] merged 2 commits into
rust-lang:mainfrom
1c3t3a:cfi-diag-mode

Conversation

@1c3t3a

@1c3t3a 1c3t3a commented Jun 9, 2026 •
edited by rustbot
Loading

Copy link
Copy Markdown
Member

View all comments

Currently a Rust CFI failure only inserts a ud2. However, for clang we have the option for a helpful diagnostic message that explains the violation and is especially helpful for fixing it. This message works through hooking the UBSan runtime and calling into it with the necessary information for a helpful error message. In clang, this is enabled via -fno-sanitize-trap=cfi.

This change adds the same behavior to rustc's CFI. Instead of a no-sanitize-trap flag, we added -Z cfi-mode={diag|trap}, with trap as the default. The diag mode will print the following error message for a violation:

tests/ui/sanitizer/cfi/fn-ptr-type-mismatch.rs:1:1: runtime error: control flow integrity check for type fn(i32, i32) -> i32 failed during indirect function call
fn_ptr_type_mismatch.ecd806f409c5c1fc-cgu.0: note: fn_ptr_type_mismatch::add_one defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior tests/ui/sanitizer/cfi/fn-ptr-type-mismatch.rs:1:1

r? @rcvalle

@rustbot

rustbot commented Jun 9, 2026

Copy link
Copy Markdown
Collaborator

Some changes occurred in tests/codegen-llvm/sanitizer

cc @rcvalle

Some changes occurred in tests/ui/sanitizer

cc @rcvalle

This PR changes how LLVM is built. Consider updating src/bootstrap/download-ci-llvm-stamp.

@rustbot rustbot added A-LLVM Area: Code generation parts specific to LLVM. Both correctness bugs and optimization-related issues. PG-exploit-mitigations Project group: Exploit mitigations S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-bootstrap Relevant to the bootstrap subteam: Rust's build system (x.py and src/bootstrap) T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. labels Jun 9, 2026
@rustbot

This comment has been minimized.

Sign in to view
@rustbot

rustbot commented Jun 9, 2026

Copy link
Copy Markdown
Collaborator

Some changes occurred in src/tools/cargo

cc @ehuss

@rustbot

This comment has been minimized.

Sign in to view
@rustbot

This comment has been minimized.

Sign in to view
@rust-log-analyzer

This comment has been minimized.

Sign in to view
@rust-log-analyzer

This comment has been minimized.

Sign in to view
@rust-log-analyzer

This comment has been minimized.

Sign in to view
@rust-log-analyzer

This comment has been minimized.

Sign in to view
@rust-log-analyzer

This comment has been minimized.

Sign in to view
@rustbot

This comment has been minimized.

Sign in to view
@rustbot

This comment has been minimized.

Sign in to view
@rust-log-analyzer

This comment has been minimized.

Sign in to view
@rust-log-analyzer

This comment has been minimized.

Sign in to view
@1c3t3a
1c3t3a requested a review from rcvalle June 10, 2026 14:29
rcvalle
rcvalle reviewed Jun 12, 2026
View reviewed changes
Comment thread compiler/rustc_codegen_llvm/src/builder.rs Outdated
@rustbot rustbot added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jun 12, 2026
@rcvalle

rcvalle commented Jun 12, 2026

Copy link
Copy Markdown
Member

Thank you for your time and work on this, Bastian! Much appreciated.

@1c3t3a
1c3t3a requested a review from rcvalle June 15, 2026 09:56
@rustbot rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Jun 15, 2026
@rust-log-analyzer

This comment has been minimized.

Sign in to view
@rust-bors

This comment has been minimized.

Sign in to view
@rcvalle

rcvalle commented Jul 28, 2026

Copy link
Copy Markdown
Member

@bors r+

@rust-bors

rust-bors Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

📋 This PR cannot be approved because it has merge conflicts. Please resolve the merge conflicts by rebasing, and try again.

@rustbot

rustbot commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

@rustbot

This comment has been minimized.

Sign in to view
1c3t3a added 2 commits July 28, 2026 21:10
@1c3t3a
cfi: add diag mode support
aea0662 
Currently a Rust CFI failure only inserts a ud2. However, for clang
we have the option for a helpful diagnostic message that explains the
violation and is especially helpful for fixing it. This message works
through hooking the UBSan runtime and calling into it with the
necessary information for a helpful error message. In clang, this is
enabled via -fno-sanitize-trap=cfi.

This change adds the same behavior to rustc's CFI. Instead of a
no-sanitize-trap flag, we added -Z cfi-mode={diag|trap}, with trap
as the default. The diag mode will print the following error message
for a violation:

```
tests/ui/sanitizer/cfi/fn-ptr-type-mismatch.rs:1:1: runtime error: control flow integrity check for type fn(i32, i32) -> i32 failed during indirect function call
fn_ptr_type_mismatch.ecd806f409c5c1fc-cgu.0: note: fn_ptr_type_mismatch::add_one defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior tests/ui/sanitizer/cfi/fn-ptr-type-mismatch.rs:1:1
```
@1c3t3a
Refactor to -Zsanitizer-cfi-diag={false,true} and -Zsanitizer-cfi-rec…
3955b03 
…over={false,true}
@rcvalle

rcvalle commented Jul 29, 2026

Copy link
Copy Markdown
Member

@bors r+

@rust-bors

rust-bors Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

📌 Commit 3955b03 has been approved by rcvalle

It is now in the queue for this repository.

@rust-bors rust-bors Bot added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jul 29, 2026
@jhpratt jhpratt mentioned this pull request Jul 30, 2026
Merged
rust-bors Bot pushed a commit that referenced this pull request Jul 30, 2026
@bors
Auto merge of #160190 - jhpratt:rollup-5Fioy6q, r=jhpratt
d108471 
Rollup of 20 pull requests

Successful merges:

 - #157669 (cfi: add diag mode support)
 - #158247 (hermit/fs: Return `unsupported()` instead of `from_raw_os_error(22)`)
 - #158649 (Hermit: fix `readdir()` )
 - #158693 (Add type-check to offload intrinisc calls)
 - #159049 (Avoid ICE in From/TryFrom cast suggestion when encountering HRTBs)
 - #159411 ([rustdoc] Correctly handle output options with --show-coverage)
 - #160053 (test: add test suite for the 85681 issue)
 - #160087 (Add regression test for nested associated-type projection ICE)
 - #160090 (rustc_resolve: Further reduce mutability in resolver)
 - #160099 (Resolver: split module resolutions into local and external resolutions)
 - #160101 (Add missing `needs-unwind` annotation to `add-spawn-hook-reentrancy-159923` test)
 - #160106 (Add suggestions for `must_implement_one_of`)
 - #160117 (Remove unnecessary format usage)
 - #160134 (Work around Wine bug 60084 by calling WSAStartup at most once)
 - #160139 (iter: specialize Take::count using advance_by)
 - #160142 (bootstrap: remove use-lld config alias)
 - #160148 (Rename `errors.rs` file to `diagnostics.rs` (15/N))
 - #160151 (Mark a doctest as requiring unwinding)
 - #160166 (Use correct feature gates for `f16`/`f128` `From` impls)
 - #160178 (Remove unused `va_start` intrinsic)
rust-bors Bot pushed a commit that referenced this pull request Jul 30, 2026
@bors
Auto merge of #160190 - jhpratt:rollup-5Fioy6q, r=jhpratt
be3d26d 
Rollup of 20 pull requests

Successful merges:

 - #157669 (cfi: add diag mode support)
 - #158247 (hermit/fs: Return `unsupported()` instead of `from_raw_os_error(22)`)
 - #158649 (Hermit: fix `readdir()` )
 - #158693 (Add type-check to offload intrinisc calls)
 - #159049 (Avoid ICE in From/TryFrom cast suggestion when encountering HRTBs)
 - #159411 ([rustdoc] Correctly handle output options with --show-coverage)
 - #160053 (test: add test suite for the 85681 issue)
 - #160087 (Add regression test for nested associated-type projection ICE)
 - #160090 (rustc_resolve: Further reduce mutability in resolver)
 - #160099 (Resolver: split module resolutions into local and external resolutions)
 - #160101 (Add missing `needs-unwind` annotation to `add-spawn-hook-reentrancy-159923` test)
 - #160106 (Add suggestions for `must_implement_one_of`)
 - #160117 (Remove unnecessary format usage)
 - #160134 (Work around Wine bug 60084 by calling WSAStartup at most once)
 - #160139 (iter: specialize Take::count using advance_by)
 - #160142 (bootstrap: remove use-lld config alias)
 - #160148 (Rename `errors.rs` file to `diagnostics.rs` (15/N))
 - #160151 (Mark a doctest as requiring unwinding)
 - #160166 (Use correct feature gates for `f16`/`f128` `From` impls)
 - #160178 (Remove unused `va_start` intrinsic)
@rust-bors
rust-bors Bot merged commit acb7f30 into rust-lang:main Jul 30, 2026
13 checks passed
rust-timer added a commit that referenced this pull request Jul 30, 2026
@rust-timer
Unrolled build for #157669
104c68c 
Rollup merge of #157669 - 1c3t3a:cfi-diag-mode, r=rcvalle

cfi: add diag mode support

Currently a Rust CFI failure only inserts a ud2. However, for clang we have the option for a helpful diagnostic message that explains the violation and is especially helpful for fixing it. This message works through hooking the UBSan runtime and calling into it with the necessary information for a helpful error message. In clang, this is enabled via `-fno-sanitize-trap=cfi`.

This change adds the same behavior to rustc's CFI. Instead of a `no-sanitize-trap` flag, we added `-Z cfi-mode={diag|trap}`, with trap as the default. The diag mode will print the following error message for a violation:

```
tests/ui/sanitizer/cfi/fn-ptr-type-mismatch.rs:1:1: runtime error: control flow integrity check for type fn(i32, i32) -> i32 failed during indirect function call
fn_ptr_type_mismatch.ecd806f409c5c1fc-cgu.0: note: fn_ptr_type_mismatch::add_one defined here
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior tests/ui/sanitizer/cfi/fn-ptr-type-mismatch.rs:1:1
```

r? @rcvalle
@rustbot rustbot added this to the 1.99.0 milestone Jul 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rcvalle rcvalle Awaiting requested review from rcvalle

Assignees

@rcvalle rcvalle

Labels

A-LLVM Area: Code generation parts specific to LLVM. Both correctness bugs and optimization-related issues. PG-exploit-mitigations Project group: Exploit mitigations S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. T-bootstrap Relevant to the bootstrap subteam: Rust's build system (x.py and src/bootstrap) T-compiler Relevant to the compiler team, which will review and decide on the PR/issue.

Projects

None yet

Milestone

1.99.0

Development

Successfully merging this pull request may close these issues.

4 participants

@1c3t3a @rustbot @rust-log-analyzer @rcvalle