rustix icon indicating copy to clipboard operation
rustix copied to clipboard

msan finding in fstat implementation

Open pefoley2 opened this issue 3 months ago • 1 comments

There appears to be a problem with https://github.com/bytecodealliance/rustix/blob/main/src/backend/linux_raw/fs/syscalls.rs#L509 producing uninitialized memory.

I got the below WARNING when running a C++ test that exercises https://github.com/jj-vcs/jj under memory sanitizer.

e.g. ==8298==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x558e78ecd3f9 in <jj_lib::lock::unix::FileLock>::lock [third_party/rust/jj_lib/v0_34/src/lock/unix.rs:50]:24 Uninitialized value was stored to memory at #0 0x558e45994dea in __msan_memcpy [third_party/llvm/llvm-project/compiler-rt/lib/msan/msan_interceptors.cpp:1755]:3 #1 0x558e7a60daa2 in rustix::backend::fs::syscalls::fstat [third_party/rust/rustix/v1/src/backend/linux_raw/fs/syscalls.rs:512]:9

The uninitialized usage occurs at: https://github.com/jj-vcs/jj/blob/main/lib/src/lock/unix.rs#L50

It seems surprising that fstat wouldn't initialize the st_nlink field, perhaps there's some kind of msan annotation missing?

pefoley2 avatar Oct 09 '25 19:10 pefoley2

The stat struct is initialized by the OS, in the fstat system call. Msan doesn't know about it because the system call happens in an asm block. In theory, code like this can be annotated with __msan_unpoison calls to tell msan when things are initialized in this way, but rustix does not yet have these.

sunfishcode avatar Oct 12 '25 18:10 sunfishcode