diff --git a/doc/src/SUMMARY.md b/doc/src/SUMMARY.md index d5885d4ec7bb7..160ba000dbaed 100644 --- a/doc/src/SUMMARY.md +++ b/doc/src/SUMMARY.md @@ -18,5 +18,6 @@ - [Pointer Arithmetic](./challenges/0003-pointer-arithmentic.md) - [Memory safety of BTreeMap's `btree::node` module](./challenges/0004-btree-node.md) - [Inductive data type](./challenges/0005-linked-list.md) + - [Safety of NonNull](./challenges/0006-nonnull.md) - [Contracts for SmallSort](./challenges/0008-smallsort.md) - [Memory safety of String](./challenges/0010-string.md) diff --git a/doc/src/challenges/0006-nonnull.md b/doc/src/challenges/0006-nonnull.md new file mode 100644 index 0000000000000..1e5d8c7bb32c4 --- /dev/null +++ b/doc/src/challenges/0006-nonnull.md @@ -0,0 +1,84 @@ +# Challenge 6: Safety of NonNull + +- **Status:** Open +- **Tracking Issue:** [Link to issue](https://github.com/model-checking/verify-rust-std/issues/53) +- **Start date:** *2024-08-16* +- **End date:** *2024-12-10* + +------------------- + + +## Goal + +Verify absence of undefined behavior of the [`ptr::NonNull` module](https://github.com/rust-lang/rust/blob/master/library/core/src/ptr/non_null.rs). +Most of its functions are marked `unsafe`, yet they are used in 62 other modules +of the standard library. + +### Success Criteria + +Prove absence of undefined behavior of the following 48 public functions. You +may wish to do so by attaching pre- and postconditions to these, and then (if +needed by the tooling that you choose to use) adding verification harnesses. + +1. `NonNull::add` +2. `NonNull::addr` +3. `NonNull::align_offset` +4. `NonNull::as_mut<'a>` +5. `NonNull::as_mut_ptr` +6. `NonNull::as_non_null_ptr` +7. `NonNull::as_ptr` +8. `NonNull::as_ref<'a>` +9. `NonNull::as_uninit_mut<'a>` +10. `NonNull::as_uninit_ref<'a>` +11. `NonNull::as_uninit_slice<'a>` +12. `NonNull::as_uninit_slice_mut<'a>` +13. `NonNull::byte_add` +14. `NonNull::byte_offset_from` +15. `NonNull::byte_offset` +16. `NonNull::byte_sub` +17. `NonNull::cast` +18. `NonNull::copy_from_nonoverlapping` +19. `NonNull::copy_from` +20. `NonNull::copy_to_nonoverlapping` +21. `NonNull::copy_to` +22. `NonNull::dangling` +23. `NonNull::drop_in_place` +24. `NonNull::from_raw_parts` +25. `NonNull::get_unchecked_mut` +26. `NonNull::is_aligned_to` +27. `NonNull::is_aligned` +28. `NonNull::is_empty` +29. `NonNull::len` +30. `NonNull::map_addr` +31. `NonNull::new_unchecked` +32. `NonNull::new` +33. `NonNull::offset_from` +34. `NonNull::offset` +35. `NonNull::read_unaligned` +36. `NonNull::read_volatile` +37. `NonNull::read` +38. `NonNull::replace` +39. `NonNull::slice_from_raw_parts` +40. `NonNull::sub_ptr` +41. `NonNull::sub` +42. `NonNull::swap` +43. `NonNull::to_raw_parts` +44. `NonNull::with_addr` +45. `NonNull::write_bytes` +46. `NonNull::write_unaligned` +47. `NonNull::write_volatile` +48. `NonNull::write` + +### List of UBs + +In addition to any properties called out as `SAFETY` comments in the source +code, +all proofs must automatically ensure the absence of the following [undefined behaviors](https://github.com/rust-lang/reference/blob/142b2ed77d33f37a9973772bd95e6144ed9dce43/src/behavior-considered-undefined.md): + +* Accessing (loading from or storing to) a place that is dangling or based on a misaligned pointer. +* Reading from uninitialized memory. +* Mutating immutable bytes. +* Producing an invalid value + +Note: All solutions to verification challenges need to satisfy the criteria established in the [challenge book](../general-rules.md) +in addition to the ones listed above.