Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adjust PropertyClass of assertions to identify UB #3860

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

tautschnig
Copy link
Member

Anything listed as undefined behavior (UB) at
https://doc.rust-lang.org/reference/behavior-considered-undefined.html must also be considered UB by Kani and should not pass under should_fail. In preparation of this PR, all occurrences of PropertyClass in the code base were audited and, where necessary, adjusted.

Also, all uses of kani::assert were audited to confirm or adjust them. This resulted in first-time use of the UnsupportedCheck hook, which implied fixes to its implementation.

Resolves: #3571

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT licenses.

Anything listed as undefined behavior (UB) at
https://doc.rust-lang.org/reference/behavior-considered-undefined.html
must also be considered UB by Kani and should not pass under
`should_fail`. In preparation of this PR, all occurrences of
`PropertyClass` in the code base were audited and, where necessary,
adjusted.

Also, all uses of `kani::assert` were audited to confirm or adjust them.
This resulted in first-time use of the `UnsupportedCheck` hook, which
implied fixes to its implementation.

Resolves: model-checking#3571
@tautschnig tautschnig requested a review from a team as a code owner January 28, 2025 14:36
@github-actions github-actions bot added the Z-BenchCI Tag a PR to run benchmark CI label Jan 28, 2025
@@ -1,16 +1,16 @@
multiple_instrumentations_different_vars.assertion.3\
multiple_instrumentations_different_vars.assertion.1\
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you remove these numbers?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will the pattern still match given we use the backslash at the end of the line?

Copy link
Contributor

@celinval celinval left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about value validity, memory initialization? I think they are all still using assertions.

Copy link
Contributor

@celinval celinval left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sorry, wrong selection... 😳

@tautschnig
Copy link
Member Author

What about value validity, memory initialization? I think they are all still using assertions.

Given how those were designed, is the only way to fix this to filter for their specific messages? My understanding is that those insert MIR-level assert calls, making them indistinguishable from user-provided assertions. Am I getting this wrong?

@celinval
Copy link
Contributor

What about value validity, memory initialization? I think they are all still using assertions.

Given how those were designed, is the only way to fix this to filter for their specific messages? My understanding is that those insert MIR-level assert calls, making them indistinguishable from user-provided assertions. Am I getting this wrong?

Can we insert calls to kani::safety_check instead of kani::assert here?

I think we can just swap this code to retrieve kani::safety_check instead of kani::assert, but it's worth checking that all users of this code are adding safety properties. Otherwise, we can create a second variant to this enum, which allows instrumentation passes to use different checks.

By looking at this code, it reminded me that we also have an internal function named kani::check. I think that's also intended to check for safety.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Z-BenchCI Tag a PR to run benchmark CI
Projects
None yet
Development

Successfully merging this pull request may close these issues.

UB checks should fail verification for harnesses annotated with #[should_panic]
2 participants