Allowing passing a null pointer to getrandom() when length is 0

[Aaron1011]

The Linux kernel will handle a null pointer passed to 'getrandom'
without error, as long as the length is also 0. The getrandom crate
relies on this behavior: https://github.com/rust-random/getrandom/blob/ab44edf3c7af721a00e22648b6c811ccb559ba81/src/linux_android.rs#L26

Since it works fine on the actual kernel (and should continue to, due to
the kernel's backwards-compatibility guarantees), Miri should support it
as well.

[RalfJung]

We already handle NULL pointers just fine when the length is 0. The not_undef just checks that the pointer is initialized, and we should definitely still do that.

I think you ran into the same getrandom bug that I also just ran into. See rust-random/getrandom#73.

(Also, did you test that your patch fixes this? Because it doesn't look like it should. I got ICEs in to_usize.)

[RalfJung]

FWIW, even with this PR, getrandom still fails here. (You can do cargo update && cargo miri test in test-cargo-miri/ to reproduce.)

[Aaron1011]

@RalfJung: Wow - I opened a duplicate PR within a few minutes of yours: rust-random/getrandom#74

However, applying either of our PRs is not sufficient to make that call to getrandom work. I think the blame actually lies with gen_random:

miri/src/helpers.rs

Line 86 in ed30152

let ptr = match this.memory().check_ptr_access(ptr, Size::from_bytes(len as u64), Align::from_bytes(1).unwrap())? {

We unconditionally try to use that pointer. I think we should add a flag to skip doing anything when the length is 0. We can enable that behavior for getrandom, and keep the current behavior for all other usages of gen_random.

[RalfJung]

I opened a duplicate PR within a few minutes of yours: rust-random/getrandom#74

Talk about race conditions. ;)

However, applying either of our PRs is not sufficient to make that call to getrandom work. I think the blame actually lies with gen_random:

Ah, good catch. check_ptr_access complains on NULL. So dangling pointers (and unaligned pointers) work fine here with size 0, but NULL pointers do not.

I find it likely that all users of gen_random are fine with NULL pointers, so I think gen_random itself should be changed to bail early if the size is 0.

[bors]

☔ The latest upstream changes (presumably #883) made this pull request unmergeable. Please resolve the merge conflicts.

[Aaron1011]

@RalfJung: I've made the change you requested

[Aaron1011]

@RalfJung Updated

[RalfJung]

Thanks!

@bors r+

[bors]

📌 Commit 4d3398f has been approved by RalfJung

[bors]

⌛ Testing commit 4d3398f with merge bc82f83...

[bors]

☀️ Test successful - checks-travis, status-appveyor
Approved by: RalfJung
Pushing bc82f83 to master...