Tooling and Testing for Unsafe Code

rustup +nightly component add miri
cargo +nightly miri test                                  # run the test suite under Miri
cargo +nightly miri run                                   # run the binary
MIRIFLAGS="-Zmiri-tree-borrows" cargo +nightly miri test  # Tree Borrows instead of Stacked Borrows
MIRIFLAGS="-Zmiri-strict-provenance" cargo +nightly miri test
MIRIFLAGS="-Zmiri-many-seeds=0..16" cargo +nightly miri test   # several schedules / allocation seeds

# AddressSanitizer: out-of-bounds, use-after-free, double free (Linux/macOS, nightly)
RUSTFLAGS="-Zsanitizer=address" RUSTDOCFLAGS="-Zsanitizer=address" \
  cargo +nightly test --target x86_64-unknown-linux-gnu

# ThreadSanitizer: data races; instrument std too for accurate results
RUSTFLAGS="-Zsanitizer=thread" cargo +nightly test -Zbuild-std --target x86_64-unknown-linux-gnu

cargo install cargo-fuzz
cargo fuzz init                     # creates fuzz/ with a libfuzzer-sys crate
cargo fuzz add parse_record
cargo +nightly fuzz run parse_record -- -max_total_time=300

// fuzz/fuzz_targets/parse_record.rs
#![no_main]
use libfuzzer_sys::fuzz_target;

fuzz_target!(|data: &[u8]| {
    // Must never panic or trigger UB for any input; ASan is on by default.
    let _ = mycrate::parse_record(data);
});

// Cargo.toml: [target.'cfg(loom)'.dev-dependencies] loom = "0.7"
#[cfg(loom)]
use loom::sync::{atomic::{AtomicUsize, Ordering}, Arc};
#[cfg(loom)]
use loom::thread;

#[cfg(loom)]
#[test]
fn two_increments_are_seen() {
    loom::model(|| {
        let n = Arc::new(AtomicUsize::new(0));
        let n2 = n.clone();
        let t = thread::spawn(move || n2.fetch_add(1, Ordering::Release));
        n.fetch_add(1, Ordering::Release);
        t.join().unwrap();
        assert_eq!(n.load(Ordering::Acquire), 2);
    });
}

[lints.rust]
unsafe_op_in_unsafe_fn = "deny"

[lints.clippy]
undocumented_unsafe_blocks = "warn"
missing_safety_doc = "warn"
multiple_unsafe_ops_per_block = "warn"

use std::cell::Cell;

/// Counts drops, to prove a container drops every element exactly once.
struct DropCounter<'a>(&'a Cell<usize>);

impl Drop for DropCounter<'_> {
    fn drop(&mut self) {
        self.0.set(self.0.get() + 1);
    }
}

#[test]
fn drops_each_element_once() {
    let drops = Cell::new(0);
    {
        let v = vec![DropCounter(&drops), DropCounter(&drops), DropCounter(&drops)];
        let mut it = v.into_iter();
        let _first = it.next();          // dropped at end of scope
    }                                    // iterator drops the remaining two
    assert_eq!(drops.get(), 3);
}

jobs:
  scan:
    steps:
      - run: |
          for t in unsafe_inventory safety_comments ub_patterns risky_calls ffi_and_globals; do
            rustc -O --edition 2021 "$SKILL/scripts/$t.rs" -o "/tmp/$t"; done
          /tmp/unsafe_inventory src/
          /tmp/ub_patterns src/ --strict
          /tmp/safety_comments src/ --strict
  miri:
    steps:
      - run: rustup toolchain install nightly --component miri
      - run: cargo +nightly miri test
      - run: MIRIFLAGS="-Zmiri-tree-borrows" cargo +nightly miri test
  asan:
    steps:
      - run: RUSTFLAGS="-Zsanitizer=address" cargo +nightly test --target x86_64-unknown-linux-gnu
  clippy:
    steps:
      - run: cargo clippy --all-targets -- -D clippy::undocumented_unsafe_blocks -D clippy::missing_safety_doc