From 06d565c967bfb7c6ff52a991bbe47b4a2a25de3e Mon Sep 17 00:00:00 2001 From: Alex Crichton Date: Wed, 13 May 2020 14:22:37 -0700 Subject: [PATCH] std: Switch from libbacktrace to gimli This commit is a proof-of-concept for switching the standard library's backtrace symbolication mechanism on most platforms from libbacktrace to gimli. The standard library's support for `RUST_BACKTRACE=1` requires in-process parsing of object files and DWARF debug information to interpret it and print the filename/line number of stack frames as part of a backtrace. Historically this support in the standard library has come from a library called "libbacktrace". The libbacktrace library seems to have been extracted from gcc at some point and is written in C. We've had a lot of issues with libbacktrace over time, unfortunately, though. The library does not appear to be actively maintained since we've had patches sit for months-to-years without comments. We have discovered a good number of soundness issues with the library itself, both when parsing valid DWARF as well as invalid DWARF. This is enough of an issue that the libs team has previously decided that we cannot feed untrusted inputs to libbacktrace. This also doesn't take into account the portability of libbacktrace which has been difficult to manage and maintain over time. While possible there are lots of exceptions and it's the main C dependency of the standard library right now. For years it's been the desire to switch over to a Rust-based solution for symbolicating backtraces. It's been assumed that we'll be using the Gimli family of crates for this purpose, which are targeted at safely and efficiently parsing DWARF debug information. I've been working recently to shore up the Gimli support in the `backtrace` crate. As of a few weeks ago the `backtrace` crate, by default, uses Gimli when loaded from crates.io. This transition has gone well enough that I figured it was time to start talking seriously about this change to the standard library. This commit is a preview of what's probably the best way to integrate the `backtrace` crate into the standard library with the Gimli feature turned on. While today it's used as a crates.io dependency, this commit switches the `backtrace` crate to a submodule of this repository which will need to be updated manually. This is not done lightly, but is thought to be the best solution. The primary reason for this is that the `backtrace` crate needs to do some pretty nontrivial filesystem interactions to locate debug information. Working without `std::fs` is not an option, and while it might be possible to do some sort of trait-based solution when prototyped it was found to be too unergonomic. Using a submodule allows the `backtrace` crate to build as a submodule of the `std` crate itself, enabling it to use `std::fs` and such. Otherwise this adds new dependencies to the standard library. This step requires extra attention because this means that these crates are now going to be included with all Rust programs by default. It's important to note, however, that we're already shipping libbacktrace with all Rust programs by default and it has a bunch of C code implementing all of this internally anyway, so we're basically already switching already-shipping functionality to Rust from C. * `object` - this crate is used to parse object file headers and contents. Very low-level support is used from this crate and almost all of it is disabled. Largely we're just using struct definitions as well as convenience methods internally to read bytes and such. * `addr2line` - this is the main meat of the implementation for symbolication. This crate depends on `gimli` for DWARF parsing and then provides interfaces needed by the `backtrace` crate to turn an address into a filename / line number. This crate is actually pretty small (fits in a single file almost!) and mirrors most of what `dwarf.c` does for libbacktrace. * `miniz_oxide` - the libbacktrace crate transparently handles compressed debug information which is compressed with zlib. This crate is used to decompress compressed debug sections. * `gimli` - not actually used directly, but a dependency of `addr2line`. * `adler32`- not used directly either, but a dependency of `miniz_oxide`. The goal of this change is to improve the safety of backtrace symbolication in the standard library, especially in the face of possibly malformed DWARF debug information. Even to this day we're still seeing segfaults in libbacktrace which could possibly become security vulnerabilities. This change should almost entirely eliminate this possibility whilc also paving the way forward to adding more features like split debug information. Some references for those interested are: * Original addition of libbacktrace - #12602 * OOM with libbacktrace - #24231 * Backtrace failure due to use of uninitialized value - #28447 * Possibility to feed untrusted data to libbacktrace - #21889 * Soundness fix for libbacktrace - #33729 * Crash in libbacktrace - #39468 * Support for macOS, never merged - ianlancetaylor/libbacktrace#2 * Performance issues with libbacktrace - #29293, #37477 * Update procedure is quite complicated due to how many patches we need to carry - #50955 * Libbacktrace doesn't work on MinGW with dynamic libs - #71060 * Segfault in libbacktrace on macOS - #71397 Switching to Rust will not make us immune to all of these issues. The crashes are expected to go away, but correctness and performance may still have bugs arise. The gimli and `backtrace` crates, however, are actively maintained unlike libbacktrace, so this should enable us to at least efficiently apply fixes as situations come up. --- .gitmodules | 3 + Cargo.lock | 88 +++++++++++++++++-------- Cargo.toml | 18 +++++ library/backtrace | 1 + library/std/Cargo.toml | 23 ++++--- library/std/build.rs | 1 + library/std/src/backtrace.rs | 21 +++--- library/std/src/lib.rs | 4 ++ library/std/src/panicking.rs | 2 +- library/std/src/sys_common/backtrace.rs | 3 +- rustfmt.toml | 1 + src/bootstrap/dist.rs | 12 +++- src/tools/tidy/src/deps.rs | 8 ++- src/tools/tidy/src/lib.rs | 1 + 14 files changed, 130 insertions(+), 56 deletions(-) create mode 160000 library/backtrace diff --git a/.gitmodules b/.gitmodules index 2eae52b2eac..a327aaa8d5a 100644 --- a/.gitmodules +++ b/.gitmodules @@ -44,3 +44,6 @@ [submodule "src/tools/rust-analyzer"] path = src/tools/rust-analyzer url = https://github.com/rust-analyzer/rust-analyzer.git +[submodule "library/backtrace"] + path = library/backtrace + url = https://github.com/rust-lang/backtrace-rs.git diff --git a/Cargo.lock b/Cargo.lock index d0ce581343f..8e0621ad96f 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1,10 +1,26 @@ # This file is automatically @generated by Cargo. # It is not intended for manual editing. [[package]] -name = "adler32" -version = "1.0.3" +name = "addr2line" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7e522997b529f05601e05166c07ed17789691f562762c7f3b987263d2dedee5c" +checksum = "1b6a2d3371669ab3ca9797670853d61402b03d0b4b9ebf33d677dfa720203072" +dependencies = [ + "compiler_builtins", + "gimli", + "rustc-std-workspace-alloc", + "rustc-std-workspace-core", +] + +[[package]] +name = "adler" +version = "0.2.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ee2a4ec343196209d6594e19543ae87a39f96d5534d7174822a3ad825dd6ed7e" +dependencies = [ + "compiler_builtins", + "rustc-std-workspace-core", +] [[package]] name = "aho-corasick" @@ -125,28 +141,14 @@ checksum = "f8aac770f1885fd7e387acedd76065302551364496e46b3dd00860b2f8359b9d" [[package]] name = "backtrace" -version = "0.3.46" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b1e692897359247cc6bb902933361652380af0f1b7651ae5c5013407f30e109e" +version = "0.3.50" dependencies = [ - "backtrace-sys", + "addr2line", "cfg-if", - "compiler_builtins", "libc", + "miniz_oxide", + "object", "rustc-demangle", - "rustc-std-workspace-core", -] - -[[package]] -name = "backtrace-sys" -version = "0.1.37" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "18fbebbe1c9d1f383a9cc7e8ccdb471b91c8d024ee9c2ca5b5346121fe8b4399" -dependencies = [ - "cc", - "compiler_builtins", - "libc", - "rustc-std-workspace-core", ] [[package]] @@ -688,9 +690,9 @@ dependencies = [ [[package]] name = "crc32fast" -version = "1.1.2" +version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e91d5240c6975ef33aeb5f148f35275c25eda8e8a5f95abe421978b05b8bf192" +checksum = "ba125de2af0df55319f41944744ad91c71113bf74a4646efff39afe1f6842db1" dependencies = [ "cfg-if", ] @@ -1023,9 +1025,9 @@ checksum = "37ab347416e802de484e4d03c7316c48f1ecb56574dfd4a46a80f173ce1de04d" [[package]] name = "flate2" -version = "1.0.12" +version = "1.0.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ad3c5233c9a940c8719031b423d7e6c16af66e031cb0420b0896f5245bf181d3" +checksum = "68c90b0fc46cf89d227cc78b40e494ff81287a92dd07631e5af0d06fe3cf885e" dependencies = [ "cfg-if", "crc32fast", @@ -1159,6 +1161,17 @@ dependencies = [ "wasi", ] +[[package]] +name = "gimli" +version = "0.22.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "aaf91faf136cb47367fa430cd46e37a788775e7fa104f8b4bcb3861dc389b724" +dependencies = [ + "compiler_builtins", + "rustc-std-workspace-alloc", + "rustc-std-workspace-core", +] + [[package]] name = "git2" version = "0.13.5" @@ -1819,11 +1832,14 @@ dependencies = [ [[package]] name = "miniz_oxide" -version = "0.3.5" +version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6f3f74f726ae935c3f514300cc6773a0c9492abc5e972d42ba0c0ebb88757625" +checksum = "be0f75932c1f6cfae3c04000e40114adf955636e19040f9c0a2c380702aa1c7f" dependencies = [ - "adler32", + "adler", + "compiler_builtins", + "rustc-std-workspace-alloc", + "rustc-std-workspace-core", ] [[package]] @@ -1955,6 +1971,17 @@ dependencies = [ "libc", ] +[[package]] +name = "object" +version = "0.20.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1ab52be62400ca80aa00285d25253d7f7c437b7375c4de678f5405d3afe82ca5" +dependencies = [ + "compiler_builtins", + "rustc-std-workspace-alloc", + "rustc-std-workspace-core", +] + [[package]] name = "once_cell" version = "1.1.0" @@ -4347,8 +4374,8 @@ dependencies = [ name = "std" version = "0.0.0" dependencies = [ + "addr2line", "alloc", - "backtrace", "cfg-if", "compiler_builtins", "core", @@ -4357,10 +4384,13 @@ dependencies = [ "hashbrown", "hermit-abi", "libc", + "miniz_oxide", + "object", "panic_abort", "panic_unwind", "profiler_builtins", "rand 0.7.3", + "rustc-demangle", "unwind", "wasi", ] diff --git a/Cargo.toml b/Cargo.toml index 4e49d697be1..1936e35aa4c 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -56,6 +56,18 @@ overflow-checks = false # per-crate configuration isn't specifiable in the environment. codegen-units = 10000 +# These dependencies of the standard library implement symbolication for +# backtraces on most platforms. Their debuginfo causes both linking to be slower +# (more data to chew through) and binaries to be larger without really all that +# much benefit. This section turns them all to down to have no debuginfo which +# helps to improve link times a little bit. +[profile.release.package] +addr2line.debug = 0 +adler.debug = 0 +gimli.debug = 0 +miniz_oxide.debug = 0 +object.debug = 0 + # We want the RLS to use the version of Cargo that we've got vendored in this # repository to ensure that the same exact version of Cargo is used by both the # RLS and the Cargo binary itself. The RLS depends on Cargo as a git repository @@ -80,5 +92,11 @@ rustc-std-workspace-core = { path = 'library/rustc-std-workspace-core' } rustc-std-workspace-alloc = { path = 'library/rustc-std-workspace-alloc' } rustc-std-workspace-std = { path = 'library/rustc-std-workspace-std' } +# This crate's integration with libstd is a bit wonky, so we use a submodule +# instead of a crates.io dependency. Make sure everything else in the repo is +# also using the submodule, however, so we can avoid duplicate copies of the +# source code for this crate. +backtrace = { path = "library/backtrace" } + [patch."https://github.com/rust-lang/rust-clippy"] clippy_lints = { path = "src/tools/clippy/clippy_lints" } diff --git a/library/backtrace b/library/backtrace new file mode 160000 index 00000000000..4083a90168d --- /dev/null +++ b/library/backtrace @@ -0,0 +1 @@ +Subproject commit 4083a90168d605b682ba166a0c01f86b3384e474 diff --git a/library/std/Cargo.toml b/library/std/Cargo.toml index b4951488fd8..474765d8638 100644 --- a/library/std/Cargo.toml +++ b/library/std/Cargo.toml @@ -22,11 +22,15 @@ profiler_builtins = { path = "../profiler_builtins", optional = true } unwind = { path = "../unwind" } hashbrown = { version = "0.6.2", default-features = false, features = ['rustc-dep-of-std'] } -[dependencies.backtrace_rs] -package = "backtrace" -version = "0.3.46" -default-features = false # without the libstd `backtrace` feature, stub out everything -features = [ "rustc-dep-of-std" ] # enable build support for integrating into libstd +# Dependencies of the `backtrace` crate +addr2line = { version = "0.13.0", optional = true, default-features = false } +rustc-demangle = { version = "0.1.4", features = ['rustc-dep-of-std'] } +miniz_oxide = { version = "0.4.0", optional = true, default-features = false } +[dependencies.object] +version = "0.20" +optional = true +default-features = false +features = ['read_core', 'elf', 'macho', 'pe'] [dev-dependencies] rand = "0.7" @@ -45,11 +49,12 @@ wasi = { version = "0.9.0", features = ['rustc-dep-of-std'], default-features = [features] backtrace = [ - "backtrace_rs/dbghelp", # backtrace/symbolize on MSVC - "backtrace_rs/libbacktrace", # symbolize on most platforms - "backtrace_rs/libunwind", # backtrace on most platforms - "backtrace_rs/dladdr", # symbolize on platforms w/o libbacktrace + "gimli-symbolize", + 'addr2line/rustc-dep-of-std', + 'object/rustc-dep-of-std', + 'miniz_oxide/rustc-dep-of-std', ] +gimli-symbolize = [] panic-unwind = ["panic_unwind"] profiler = ["profiler_builtins"] diff --git a/library/std/build.rs b/library/std/build.rs index 43a3327d84b..83073cc77dd 100644 --- a/library/std/build.rs +++ b/library/std/build.rs @@ -88,4 +88,5 @@ fn main() { println!("cargo:rustc-cfg=feature=\"restricted-std\""); } println!("cargo:rustc-env=STD_ENV_ARCH={}", env::var("CARGO_CFG_TARGET_ARCH").unwrap()); + println!("cargo:rustc-cfg=backtrace_in_libstd"); } diff --git a/library/std/src/backtrace.rs b/library/std/src/backtrace.rs index 02e6811bc3f..09f83ea5fca 100644 --- a/library/std/src/backtrace.rs +++ b/library/std/src/backtrace.rs @@ -91,6 +91,7 @@ // `Backtrace`, but that's a relatively small price to pay relative to capturing // a backtrace or actually symbolizing it. +use crate::backtrace_rs::{self, BytesOrWideString}; use crate::env; use crate::ffi::c_void; use crate::fmt; @@ -98,8 +99,6 @@ use crate::sync::Mutex; use crate::sys_common::backtrace::{lock, output_filename}; use crate::vec::Vec; -use backtrace::BytesOrWideString; -use backtrace_rs as backtrace; /// A captured OS thread stack backtrace. /// @@ -150,7 +149,7 @@ struct BacktraceFrame { } enum RawFrame { - Actual(backtrace::Frame), + Actual(backtrace_rs::Frame), #[cfg(test)] Fake, } @@ -197,7 +196,7 @@ impl fmt::Debug for BacktraceSymbol { fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result { write!(fmt, "{{ ")?; - if let Some(fn_name) = self.name.as_ref().map(|b| backtrace::SymbolName::new(b)) { + if let Some(fn_name) = self.name.as_ref().map(|b| backtrace_rs::SymbolName::new(b)) { write!(fmt, "fn: \"{:#}\"", fn_name)?; } else { write!(fmt, "fn: ")?; @@ -223,7 +222,7 @@ fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result { BytesOrWide::Bytes(w) => BytesOrWideString::Bytes(w), BytesOrWide::Wide(w) => BytesOrWideString::Wide(w), }, - backtrace::PrintFmt::Short, + backtrace_rs::PrintFmt::Short, crate::env::current_dir().as_ref().ok(), ) } @@ -305,7 +304,7 @@ fn create(ip: usize) -> Backtrace { let mut frames = Vec::new(); let mut actual_start = None; unsafe { - backtrace::trace_unsynchronized(|frame| { + backtrace_rs::trace_unsynchronized(|frame| { frames.push(BacktraceFrame { frame: RawFrame::Actual(frame.clone()), symbols: Vec::new(), @@ -356,9 +355,9 @@ fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result { let full = fmt.alternate(); let (frames, style) = if full { - (&capture.frames[..], backtrace::PrintFmt::Full) + (&capture.frames[..], backtrace_rs::PrintFmt::Full) } else { - (&capture.frames[capture.actual_start..], backtrace::PrintFmt::Short) + (&capture.frames[capture.actual_start..], backtrace_rs::PrintFmt::Short) }; // When printing paths we try to strip the cwd if it exists, otherwise @@ -370,7 +369,7 @@ fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result { output_filename(fmt, path, style, cwd.as_ref().ok()) }; - let mut f = backtrace::BacktraceFmt::new(fmt, style, &mut print_path); + let mut f = backtrace_rs::BacktraceFmt::new(fmt, style, &mut print_path); f.add_context()?; for frame in frames { let mut f = f.frame(); @@ -380,7 +379,7 @@ fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result { for symbol in frame.symbols.iter() { f.print_raw( frame.frame.ip(), - symbol.name.as_ref().map(|b| backtrace::SymbolName::new(b)), + symbol.name.as_ref().map(|b| backtrace_rs::SymbolName::new(b)), symbol.filename.as_ref().map(|b| match b { BytesOrWide::Bytes(w) => BytesOrWideString::Bytes(w), BytesOrWide::Wide(w) => BytesOrWideString::Wide(w), @@ -415,7 +414,7 @@ fn resolve(&mut self) { RawFrame::Fake => unimplemented!(), }; unsafe { - backtrace::resolve_frame_unsynchronized(frame, |symbol| { + backtrace_rs::resolve_frame_unsynchronized(frame, |symbol| { symbols.push(BacktraceSymbol { name: symbol.name().map(|m| m.as_bytes().to_vec()), filename: symbol.filename_raw().map(|b| match b { diff --git a/library/std/src/lib.rs b/library/std/src/lib.rs index c6e5b0a492a..30e1514a8b8 100644 --- a/library/std/src/lib.rs +++ b/library/std/src/lib.rs @@ -511,6 +511,10 @@ pub mod task { // compiler pub mod rt; +#[path = "../../backtrace/src/lib.rs"] +#[allow(dead_code, unused_attributes)] +mod backtrace_rs; + // Pull in the `std_detect` crate directly into libstd. The contents of // `std_detect` are in a different repository: rust-lang/stdarch. // diff --git a/library/std/src/panicking.rs b/library/std/src/panicking.rs index 9542e7209b4..ab2a6010306 100644 --- a/library/std/src/panicking.rs +++ b/library/std/src/panicking.rs @@ -171,7 +171,7 @@ fn default_hook(info: &PanicInfo<'_>) { // If this is a double panic, make sure that we print a backtrace // for this panic. Otherwise only print it if logging is enabled. let backtrace_env = if panic_count::get() >= 2 { - RustBacktrace::Print(backtrace_rs::PrintFmt::Full) + RustBacktrace::Print(crate::backtrace_rs::PrintFmt::Full) } else { backtrace::rust_backtrace_env() }; diff --git a/library/std/src/sys_common/backtrace.rs b/library/std/src/sys_common/backtrace.rs index e9b1e86d7ae..d386a656e4f 100644 --- a/library/std/src/sys_common/backtrace.rs +++ b/library/std/src/sys_common/backtrace.rs @@ -1,3 +1,4 @@ +use crate::backtrace_rs::{self, BacktraceFmt, BytesOrWideString, PrintFmt}; use crate::borrow::Cow; /// Common code for printing the backtrace in the same way across the different /// supported platforms. @@ -9,8 +10,6 @@ use crate::sync::atomic::{self, Ordering}; use crate::sys::mutex::Mutex; -use backtrace_rs::{BacktraceFmt, BytesOrWideString, PrintFmt}; - /// Max number of frames to print. const MAX_NB_FRAMES: usize = 100; diff --git a/rustfmt.toml b/rustfmt.toml index cb689098f89..26cdcfff2a3 100644 --- a/rustfmt.toml +++ b/rustfmt.toml @@ -14,6 +14,7 @@ ignore = [ "src/test", # do not format submodules + "library/backtrace", "library/stdarch", "src/doc/book", "src/doc/edition-guide", diff --git a/src/bootstrap/dist.rs b/src/bootstrap/dist.rs index 7f10d7895a5..a4a1d5193b9 100644 --- a/src/bootstrap/dist.rs +++ b/src/bootstrap/dist.rs @@ -1016,7 +1016,17 @@ fn run(self, builder: &Builder<'_>) -> PathBuf { let src_files = ["Cargo.lock"]; // This is the reduced set of paths which will become the rust-src component // (essentially libstd and all of its path dependencies). - copy_src_dirs(builder, &builder.src, &["library"], &[], &dst_src); + copy_src_dirs( + builder, + &builder.src, + &["library"], + &[ + // not needed and contains symlinks which rustup currently + // chokes on when unpacking. + "library/backtrace/crates", + ], + &dst_src, + ); for file in src_files.iter() { builder.copy(&builder.src.join(file), &dst_src.join(file)); } diff --git a/src/tools/tidy/src/deps.rs b/src/tools/tidy/src/deps.rs index 56d2717c304..8769d5e17bb 100644 --- a/src/tools/tidy/src/deps.rs +++ b/src/tools/tidy/src/deps.rs @@ -17,6 +17,7 @@ "MIT", "Unlicense/MIT", "Unlicense OR MIT", + "0BSD OR MIT OR Apache-2.0", // adler license ]; /// These are exceptions to Rust's permissive licensing policy, and @@ -36,7 +37,6 @@ ("ryu", "Apache-2.0 OR BSL-1.0"), // rls/cargo/... (because of serde) ("bytesize", "Apache-2.0"), // cargo ("im-rc", "MPL-2.0+"), // cargo - ("adler32", "BSD-3-Clause AND Zlib"), // cargo dep that isn't used ("constant_time_eq", "CC0-1.0"), // rustfmt ("sized-chunks", "MPL-2.0+"), // cargo via im-rc ("bitmaps", "MPL-2.0+"), // cargo via im-rc @@ -57,7 +57,8 @@ /// This list is here to provide a speed-bump to adding a new dependency to /// rustc. Please check with the compiler team before adding an entry. const PERMITTED_DEPENDENCIES: &[&str] = &[ - "adler32", + "addr2line", + "adler", "aho-corasick", "annotate-snippets", "ansi_term", @@ -65,7 +66,6 @@ "atty", "autocfg", "backtrace", - "backtrace-sys", "bitflags", "block-buffer", "block-padding", @@ -98,6 +98,7 @@ "generic-array", "getopts", "getrandom", + "gimli", "hashbrown", "hermit-abi", "humantime", @@ -119,6 +120,7 @@ "miniz_oxide", "nodrop", "num_cpus", + "object", "once_cell", "opaque-debug", "parking_lot", diff --git a/src/tools/tidy/src/lib.rs b/src/tools/tidy/src/lib.rs index 08b2fccd73f..19218cbd66a 100644 --- a/src/tools/tidy/src/lib.rs +++ b/src/tools/tidy/src/lib.rs @@ -51,6 +51,7 @@ macro_rules! tidy_error { fn filter_dirs(path: &Path) -> bool { let skip = [ "src/llvm-project", + "library/backtrace", "library/stdarch", "src/tools/cargo", "src/tools/clippy",