Detect UB due to unwinding past `extern "C"` functions

[RalfJung]

Even with rust-lang/rust#76570, I think it is possible to unwind past an extern "C" function by setting an #[unwind] attribute, and that is UB. We should make sure Miri detects that UB.

[RalfJung]

Testcase that should be detected as UB my Miri:

#![feature(unwind_attributes)]

#[unwind(allowed)]
extern "C" fn unwind() {
    panic!();
}

fn main() {
    std::panic::catch_unwind(|| unwind()).unwrap_err();
}

[bjorn3]

https://github.com/rust-lang/rust/blob/b3ac52646f7591a811fa9bf55995b24fd17ece08/compiler/rustc_mir_build/src/build/mod.rs#L562-L567

#[unwind] is checked first. Only if no #[unwind] is found, is the abi checked.

[RalfJung]

Yes, unwind(allowed) removes the abort-on-panic wrapper.

But that has no effect on UB, I presume? The RFC does not say that these attributes change the fact that unwinding past an extern "C" function is UB.

[bjorn3]

I would assume that #[unwind] will eventually be removed. All uses of #[unwind(allowed)] in the standard library can be replaced with extern "C unwind"/extern "system unwind" as far as I know.

[RalfJung]

I would assume that #[unwind] will eventually be removed.

That would make sense... I was wondering what the point of that attribute is. "Letting one cause UB" doesn't sound very convincing except when it comes to crafting Miri testcases. ;)

[RalfJung]

This would still be UB though I think:

#![feature(c_unwind)]

extern "C-unwind" fn unwind() {
    panic!();
}

fn main() {
    let unwind: extern "C-unwind" fn() = unwind;
    let unwind: extern "C" fn() = unsafe { std::mem::transmute(unwind) };
    std::panic::catch_unwind(|| unwind()).unwrap_err();
}

The caller uses a non-unwinding ABI so it might not have cleanup blocks; unwinding anyway is thus UB.

[bjorn3]

Yes, the MIR of the caller would omit cleanup blocks.

[RalfJung]

But that has no effect on UB, I presume? The RFC does not say that these attributes change the fact that unwinding past an extern "C" function is UB.

I since then learned that indeed it does affect UB; nounwind is suppressed when #[unwind(allowed)] is set.