Add LLVM realtime sanitizer #147935

luca3s · 2025-10-21T07:46:17Z

This is a new attempt at adding the LLVM real-time sanitizer to rust.

Previously this was attempted in rust-lang/rfcs#3766.

Since then the sanitize attribute was introduced in #142681 and it is a lot more flexible than the old no_santize attribute. This allows adding real-time sanitizer without the need for a new attribute, like it was proposed in the RFC. Because i only add a new value to a existing command line flag and to a attribute i don't think an MCP is necessary.

Currently real-time santizer is usable in rust code with the rtsan-standalone crate. This downloads or builds the sanitizer runtime and then links it into the rust binary.

The first commit adds support for more detailed sanitizer information.
The second commit then actually adds real-time sanitizer.
The third adds a warning against using real-time sanitizer with async functions, cloures and blocks because it doesn't behave as expected when used with async functions. I am not sure if this is actually wanted, so i kept it in a seperate commit.
The fourth commit adds the documentation for real-time sanitizer.

rustbot · 2025-10-21T07:46:20Z

compiletest directives have been modified. Please add or update docs for the
new or modified directive in src/doc/rustc-dev-guide/.

Some changes occurred in tests/ui/sanitizer

cc @rcvalle

Some changes occurred in src/tools/compiletest

cc @jieyouxu

Some changes occurred in compiler/rustc_codegen_ssa

cc @WaffleLapkin

Some changes occurred in compiler/rustc_hir/src/attrs

cc @jdonszelmann

These commits modify compiler targets.
(See the Target Tier Policy.)

Some changes occurred in src/doc/unstable-book/src/compiler-flags/sanitizer.md

cc @rust-lang/project-exploit-mitigations, @rcvalle

Some changes occurred in compiler/rustc_attr_parsing

cc @jdonszelmann

This PR changes how LLVM is built. Consider updating src/bootstrap/download-ci-llvm-stamp.

Some changes occurred to MIR optimizations

cc @rust-lang/wg-mir-opt

The rustc-dev-guide subtree was changed. If this PR only touches the dev guide consider submitting a PR directly to rust-lang/rustc-dev-guide otherwise thank you for updating the dev guide with your changes.

cc @BoxyUwU, @jieyouxu, @Kobzol, @tshepang

Some changes occurred in compiler/rustc_passes/src/check_attr.rs

cc @jdonszelmann

rustbot · 2025-10-21T07:46:23Z

r? @petrochenkov

rustbot has assigned @petrochenkov.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

jdonszelmann · 2025-10-21T07:49:32Z

Looks ok from attr parsing pov :)

compiler/rustc_llvm/llvm-wrapper/PassWrapper.cpp

petrochenkov · 2025-10-21T12:29:00Z

This change has a lang component (marking functions a blocking or non-blocking), so I'll send this to lang team first, before reviewing the implementation in detail.

traviscross · 2025-10-22T17:38:16Z

Thanks for checking with us. We talked about this in the lang meeting today. We were OK with this going forward experimentally in nightly.

We talked about how, ahead of stabilization, we'd like to see the feature flags for the individual sanitizers be separate to facilitate our review, as we're likely to want to stabilize these incrementally.

error_out.txt

tmandry · 2025-10-22T17:39:18Z

compiler/rustc_lint_defs/src/builtin.rs

+declare_lint! {
+    /// The `rtsan_nonblocking_async` lint detects incompatible use of
+    /// [`#[sanitize(realtime = "nonblocking")]`][sanitize] on async functions.
+    ///
+    /// [sanitize]: https://doc.rust-lang.org/nightly/unstable-book/language-features/no-sanitize.html
+    /// ### Example
+    ///
+    /// ```rust
+    /// #![feature(sanitize)]
+    ///
+    /// #[sanitize(realtime = "nonblocking")]
+    /// async fn x() {}
+    ///
+    /// fn main() {
+    ///     x()
+    /// }
+    /// ```
+    ///
+    /// {{produces}}
+    ///
+    /// ### Explanation
+    ///
+    /// The sanitizer only considers the async function body nonblocking. The executor, which runs on
+    /// every `.await` point can run non-realtime code, without the sanitizer catching it.
+    pub RTSAN_NONBLOCKING_ASYNC,
+    Warn,
+    r#"detects incompatible uses of `#[sanitize(realtime = "nonblocking")]` on async functions"#,
+}


It seems like the sanitizer should warn on .await from a nonblocking context then. Including in async blocks and closures.

Yes, that sounds correct. I will try to implement this.

For async fn there are multiple functions being generated. One that constructs a future, second that drops it, and third that polls it. Usually (by default) attributes apply to the first one, which in this case makes the least sense, since a function that constructs the future never blocks.

EDIT: Never mind. Since in effect sanitizer attributes are computed recursively, they are inherited by default unlike all other attributes.

I managed to also catch async blocks and async closures with the warning.

I am unsure on how to deal with the three function split for the "nonblocking" attribute.
I assume it is possible to apply attributes to the other generated functions?
I could apply the attribute to all three functions (or just the polling and drop function), but i don't know if this really makes sense. It still won't behave as expected, as the executor still won't be sanitized, so there is a lot of code between the start and the end of the function that rtsan doesn't "see" (the original reason for adding the warning).

For the "blocking" attribute i will probably apply the attribute to the polling and destructing functions, because these are the only ones that run user defined code.

@tmiasko i have now read your edit.
So i don't need to change anything here, correct? The attributes get applied to all three functions, which is the best that can be done.

No, I don't expect any specific changes. Just a general suggestion to review whether the existing behavior makes sense.

As far as I understand, for a function that constructs a future, sanitizer settings are based on attributes of async fn item (and inherited from a parent). A polling function is logically nested inside, so its settings are are inherited from async fn item. A drop function is an instantiation of drop_in_place from core and therefore uses sanitizer settings of drop_in_place.

luca3s · 2025-10-24T07:30:26Z

Since T-lang discussed this:
@rustbot label +S-waiting-on-review -S-waiting-on-t-lang

src/doc/rustc-dev-guide/src/sanitizers.md

compiler/rustc_hir/src/attrs/data_structures.rs

petrochenkov · 2025-10-24T12:09:33Z

compiler/rustc_codegen_ssa/src/codegen_attrs.rs

+    let sanitizers = tcx.sanitizer_settings_for(did);
+    codegen_fn_attrs.sanitizers.disabled |= sanitizers.disabled;
+    if codegen_fn_attrs.sanitizers.rtsan_setting == RtsanSetting::default() {
+        codegen_fn_attrs.sanitizers.rtsan_setting = sanitizers.rtsan_setting;


Is it ok here that explicit #[sanitize(realtime = "blocking")] will be equivalent to not specifying the sanitizer attribute at all? It will also be overridden.

I am not completely sure what you mean.
The behaviour for the new sanitizer should be the same as for the other sanitizers. For example if address sanitizer is set in the passed in codegen_fn_attrs it doesn't matter what the value in the tcx.sanitizer_settings_for is, because of binary or.

For rtsan i have done the same: If the setting is non-default in the passed in codegen_fn_attrs it doesn't matter what the setting from tcx.sanitizer_settings_for is.

petrochenkov · 2025-10-24T12:10:59Z

compiler/rustc_codegen_ssa/src/codegen_attrs.rs

+        let hir_id = tcx.local_def_id_to_hir_id(did);
+        tcx.node_span_lint(lint::builtin::RTSAN_NONBLOCKING_ASYNC, hir_id, sanitize_span, |lint| {
+                lint.primary_message(r#"the async executor can run blocking code, without realtime sanitizer catching it"#);
+            });


Nit: weird formatting, if rustfmt skips this code, then it can be adjusted manually.

Do you mean the if condition or the node_span_lint call?

I did some changes. let me know if you are happy with it.

rustbot assigned petrochenkov Oct 21, 2025

This comment has been minimized.

Sign in to view

luca3s force-pushed the add-rtsan branch from 1a39a8d to a8fc414 Compare October 21, 2025 07:58

This comment has been minimized.

Sign in to view

luca3s commented Oct 21, 2025

View reviewed changes

compiler/rustc_llvm/llvm-wrapper/PassWrapper.cpp Outdated Show resolved Hide resolved

luca3s force-pushed the add-rtsan branch from a8fc414 to 28d5767 Compare October 21, 2025 08:29

This comment has been minimized.

Sign in to view

luca3s force-pushed the add-rtsan branch from 28d5767 to 7133d59 Compare October 21, 2025 09:26

This comment has been minimized.

Sign in to view

This comment was marked as outdated.

Sign in to view

traviscross added the P-lang-drag-1 Lang team prioritization drag level 1. https://rust-lang.zulipchat.com/#narrow/channel/410516-t-lang label Oct 22, 2025

traviscross removed the I-lang-nominated Nominated for discussion during a lang team meeting. label Oct 22, 2025

traviscross added I-lang-radar Items that are on lang's radar and will need eventual work or consideration. and removed P-lang-drag-1 Lang team prioritization drag level 1. https://rust-lang.zulipchat.com/#narrow/channel/410516-t-lang labels Oct 22, 2025

tmandry reviewed Oct 22, 2025

View reviewed changes

luca3s force-pushed the add-rtsan branch from 7133d59 to ae7eb23 Compare October 22, 2025 22:04

This comment has been minimized.

Sign in to view

luca3s force-pushed the add-rtsan branch from ae7eb23 to 193cf1c Compare October 23, 2025 12:00

tomassedovic mentioned this pull request Oct 23, 2025

Tracking issue for sanitizer support #39699

Open

5 tasks

This comment has been minimized.

Sign in to view

luca3s force-pushed the add-rtsan branch from 193cf1c to cc2db36 Compare October 23, 2025 13:40

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-t-lang Status: Awaiting decision from T-lang labels Oct 24, 2025

petrochenkov reviewed Oct 24, 2025

View reviewed changes

petrochenkov added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Oct 24, 2025

luca3s and others added 4 commits October 24, 2025 15:47

replace SanitizerSet in CodegenFnAttrs by new type

ab9c644

add realtime sanitizer

bc2ca26

add warning for async

25afc89

add docs

0573b22

luca3s force-pushed the add-rtsan branch from cc2db36 to 0573b22 Compare October 24, 2025 13:56

traviscross added the P-lang-drag-1 Lang team prioritization drag level 1. https://rust-lang.zulipchat.com/#narrow/channel/410516-t-lang label Oct 25, 2025

Add LLVM realtime sanitizer #147935

Are you sure you want to change the base?

Add LLVM realtime sanitizer #147935

Conversation

luca3s commented Oct 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rustbot commented Oct 21, 2025

Uh oh!

rustbot commented Oct 21, 2025

Uh oh!

jdonszelmann commented Oct 21, 2025

Uh oh!

This comment has been minimized.

This comment has been minimized.

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment was marked as outdated.

petrochenkov commented Oct 21, 2025

Uh oh!

traviscross commented Oct 22, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tmiasko Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

luca3s commented Oct 24, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

luca3s commented Oct 21, 2025 •

edited

Loading

tmiasko Oct 22, 2025 •

edited

Loading