Skip to content

Commit f46b255

committed

std: detect stack overflows in TLS destructors on UNIX

Fixes #111272. With #127912 merged, we now have all the infrastructure in place to support stack overflow detection in TLS destructors. This was not possible before because the signal stack was freed in the thread main function, thus a SIGSEGV afterwards would immediately crash. And on platforms without native TLS, the guard page address was stored in an allocation freed in a TLS destructor, so would not be available. #127912 introduced the `local_pointer` macro which allows storing a pointer-sized TLS variable without allocation and the `thread_cleanup` runtime function which is called after all other code managed by the Rust runtime. This PR simply moves the signal stack cleanup to the end of `thread_cleanup` and uses `local_pointer` to store every necessary variable. And so, everything run under the Rust runtime is now properly protected against stack overflows.

1 parent 11ee3a8 commit f46b255Copy full SHA for f46b255

File tree

13 files changed

+196

-177

lines changed

library/std/src
- rt.rs
- sys/pal
  - hermit
    - mod.rs
  - sgx
    - mod.rs
  - solid
    - mod.rs
  - teeos
    - mod.rs
  - uefi
    - mod.rs
  - unix
  - unsupported
    - common.rs
  - windows
    - mod.rs
  - zkvm
    - mod.rs
tests/ui/runtime
- out-of-stack.rs

13 files changed

+196

-177

lines changed

`‎library/std/src/rt.rs`

Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -117,6 +117,7 @@ pub(crate) fn thread_cleanup() {`
`117`	`117`	`// print a nice message.`
`118`	`118`	`panic::catch_unwind(\|\| {`
`119`	`119`	`crate::thread::drop_current();`
	`120`	`+ crate::sys::thread_cleanup();`
`120`	`121`	`})`
`121`	`122`	`.unwrap_or_else(handle_rt_panic);`
`122`	`123`	`}`

`‎library/std/src/sys/pal/hermit/mod.rs`

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -69,6 +69,8 @@ pub unsafe fn init(argc: isize, argv: const const u8, _sigpipe: u8) {`
`69`	`69`	`}`
`70`	`70`	`}`
`71`	`71`
	`72`	`+pub fn thread_cleanup() {}`
	`73`	`+`
`72`	`74`	`// SAFETY: must be called only once during runtime cleanup.`
`73`	`75`	`// NOTE: this is not guaranteed to run, for example when the program aborts.`
`74`	`76`	`pub unsafe fn cleanup() {}`

`‎library/std/src/sys/pal/sgx/mod.rs`

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,8 @@ pub unsafe fn init(argc: isize, argv: const const u8, _sigpipe: u8) {`
`37`	`37`	`}`
`38`	`38`	`}`
`39`	`39`
	`40`	`+pub fn thread_cleanup() {}`
	`41`	`+`
`40`	`42`	`// SAFETY: must be called only once during runtime cleanup.`
`41`	`43`	`// NOTE: this is not guaranteed to run, for example when the program aborts.`
`42`	`44`	`pub unsafe fn cleanup() {}`

`‎library/std/src/sys/pal/solid/mod.rs`

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -38,6 +38,8 @@ pub mod time;`
`38`	`38`	`// NOTE: this is not guaranteed to run, for example when Rust code is called externally.`
`39`	`39`	`pub unsafe fn init(_argc: isize, _argv: const const u8, _sigpipe: u8) {}`
`40`	`40`
	`41`	`+pub fn thread_cleanup() {}`
	`42`	`+`
`41`	`43`	`// SAFETY: must be called only once during runtime cleanup.`
`42`	`44`	`pub unsafe fn cleanup() {}`
`43`	`45`

`‎library/std/src/sys/pal/teeos/mod.rs`

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,8 @@ pub fn abort_internal() -> ! {`
`37`	`37`	`// so this should never be called.`
`38`	`38`	`pub fn init(argc: isize, argv: const const u8, sigpipe: u8) {}`
`39`	`39`
	`40`	`+pub fn thread_cleanup() {}`
	`41`	`+`
`40`	`42`	`// SAFETY: must be called only once during runtime cleanup.`
`41`	`43`	`// this is not guaranteed to run, for example when the program aborts.`
`42`	`44`	`pub unsafe fn cleanup() {`

`‎library/std/src/sys/pal/uefi/mod.rs`

Lines changed: 2 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -77,6 +77,8 @@ pub(crate) unsafe fn init(argc: isize, argv: const const u8, _sigpipe: u8) {`
`77`	`77`	`}`
`78`	`78`	`}`
`79`	`79`
	`80`	`+pub fn thread_cleanup() {}`
	`81`	`+`
`80`	`82`	`/// # SAFETY`
`81`	`83`	`/// this is not guaranteed to run, for example when the program aborts.`
`82`	`84`	`/// - must be called only once during runtime cleanup.`

`‎library/std/src/sys/pal/unix/mod.rs`

Lines changed: 6 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -54,7 +54,7 @@ pub unsafe fn init(argc: isize, argv: const const u8, sigpipe: u8) {`
`54`	`54`	`// behavior.`
`55`	`55`	`reset_sigpipe(sigpipe);`
`56`	`56`
`57`		`- stack_overflow::init();`
	`57`	`+ stack_overflow::protect(true);`
`58`	`58`	`args::init(argc, argv);`
`59`	`59`
`60`	`60`	// Normally, `thread::spawn` will call `Thread::set_name` but since this thread
`@@ -228,12 +228,14 @@ pub(crate) fn on_broken_pipe_flag_used() -> bool {`
`228`	`228`	`ON_BROKEN_PIPE_FLAG_USED.load(crate::sync::atomic::Ordering::Relaxed)`
`229`	`229`	`}`
`230`	`230`
`231`		`-// SAFETY: must be called only once during runtime cleanup.`
`232`		`-// NOTE: this is not guaranteed to run, for example when the program aborts.`
`233`		`-pub unsafe fn cleanup() {`
	`231`	`+pub fn thread_cleanup() {`
`234`	`232`	`stack_overflow::cleanup();`
`235`	`233`	`}`
`236`	`234`
	`235`	`+// SAFETY: must be called only once during runtime cleanup.`
	`236`	`+// NOTE: this is not guaranteed to run, for example when the program aborts.`
	`237`	`+pub unsafe fn cleanup() {}`
	`238`	`+`
`237`	`239`	`#[allow(unused_imports)]`
`238`	`240`	`pub use libc::signal;`
`239`	`241`

0 commit comments

Comments

(0)