CFI breaks when dropping trait object

[maurer]

I tried this code:

use std::sync::Arc;
use std::borrow::Borrow;

trait Fooable {
    fn foo(&self) -> i32;
}

struct Bar;

impl Fooable for Bar {
    fn foo(&self) -> i32 {
        3
    }
}

fn do_foo(x: Arc<dyn Fooable>) -> i32 {
    x.foo()
}

fn ref_foo(x: &dyn Fooable) -> i32 {
    x.foo()
}

fn main() {
    let arc: Arc<dyn Fooable> = Arc::new(Bar);
    println!("base: {}",Bar.foo());
    println!("ref: {}", ref_foo(&Bar));
    println!("xlat: {}", ref_foo(arc.borrow()));
    // This one will crash on illegal instruction
    println!("{}", do_foo(arc))
}

built with rustc -Z sanitizer=cfi -Clto -Ccodegen-units=1 cfi_tester.rs

I expected to see this happen: All print statements should run, the program should exit cleanly

Instead, this happened:

mmaurer@anyblade:~$ rustc -Z sanitizer=cfi -Clto -Ccodegen-units=1 cfi_tester.rs
mmaurer@anyblade:~$ ./cfi_tester 
base: 3
ref: 3
xlat: 3
Illegal instruction
mmaurer@anyblade:~$ echo $?
132
mmaurer@anyblade:~$ 

Meta

rustc --version --verbose:

rustc 1.76.0-nightly (9fad68599 2023-12-03)

I don't believe this has ever worked, and it is at least broken back to 1.73.0 if it did.

cc @rcvalle

[maurer]

I think I may have conflated two issues, and am working on boiling this down a bit further - the source of this is that I'm trying to turn on KCFI in the kernel and hitting this with their custom Arc, and there I initially got a report saying that a .foo() style call through an Arc was failing.

After looking at my example in more detail though, it's not exercising that problem. It's triggering this one:

struct Bar;
trait Fooable {}
impl Fooable for Bar {}

fn main() {
    let _: Box<dyn Fooable> = Box::new(Bar);
}

which will also Illegal Instruction. I'll change the title of the issue and file another one if I come up with a clean example for the alternate receiver problem I'm seeing in more complex code.

[Noratrieb]

cc @rcvalle

[Jules-Bertholet]

@rustbot label A-sanitizers

[maurer]

rcvalle and I collaboratively fixed this in a long series of patches