Re: Can the Kernel Concurrency Sanitizer Own Rust Code?

On Thu, 7 Oct 2021 15:30:10 -0700
"Paul E. McKenney" [off-list ref] wrote:

For C/C++, I would have written "translation unit".  But my guess is
that "Rust module" would work better.

Thoughts?

Module is not a translation unit in Rust, it is more like C++
namespaces. The translation unit equivalent in Rust is crate.

And the definition of a module is constrained to be contained within a
given translation unit, correct?

Correct.

But what prevents unsafe Rust code in one translation unit from
violating the assumptions of safe Rust code in another translation
unit, Rust modules notwithstanding?  Especially if that unsafe code
contains a bug?

Unsafe code obviously can do all sorts of crazy things and hence
they're unsafe :)

However your article is talking about "safe code can violate unsafe
code's assumptions" and this would only apply if they are in the same
Rust module.

When one writes a safe abstraction using unsafe code they need to prove
that the usage is correct. Most properties used to construct such a
proof would be a local type invariant (like `ptr` being a valid,
non-null pointer in `File` example).

Sometimes the code may rely on invariants of a foreign type that it
depends on (e.g. If I have a `ptr: NonNull<bindings::file>` then I
would expect `ptr.as_ptr()` to be non-null, and `as_ptr` is indeed
implemented in Rust's libcore as safe code. But safe code of a
*downstream* crate cannot violate upstream unsafe code's assumption.

Finally, are you arguing that LTO cannot under any circumstances
inflict a bug in Rust unsafe code on Rust safe code in some other
translation unit? Or just that if there are no bugs in Rust code
(either safe or unsafe), that LTO cannot possibly introduce any?

I don't see why LTO is significant in the argument. Doing LTO or not
wouldn't change the number of bugs. It could make a bug more or less
visible, but buggy code remains buggy and bug-free code remains
bug-free.

If I have expose a safe `invoke_ub` function in a translation unit that
internally causes UB using unsafe code, and have another
all-safe-code crate calling it, then the whole program has UB
regardless LTO is enabled or not.

- Gary