Potential false positive for invalid_runtime_symbol_definitions lint

[hkalbasi]

I tried this code:

unsafe extern "C" {
    fn exit(s: i32);
}

fn main() {
    unsafe { exit(5); }
}

I expected to see this happen: Compilation succeed and program returned 5

Instead, this happened:

error: invalid definition of the runtime `exit` symbol used by the standard library
 --> <source>:4:5
  |
4 |     fn exit(s: i32);
  |     ^^^^^^^^^^^^^^^^
  |
  = note: expected `unsafe extern "C" fn(i32) -> !`
          found    `unsafe extern "C" fn(i32)`
  = help: either fix the signature or remove any attributes like `#[unsafe(no_mangle)]`, `#[unsafe(export_name = "exit")]`, or `#[link_name = "exit"]`
  = note: `#[deny(invalid_runtime_symbol_definitions)]` on by default

error: aborting due to 1 previous error; 2 warnings emitted

Compiler returned: 1

It might be suspicious, but it is not invalid definitely.

Meta

I hit this bug in CO2 which is basically a C frontend for rustc. I would like to enable this very useful lint at least warn by default, but I don't want to annoy C people by forcing them to add __atribute__((no_return)) to their void exit(int); declarations. I expect c2rust to have a similar problem.

cc @Urgau #155521

[Urgau]

POSIX.1-2024 and the "ISO C standard" documents that "The exit() function does not return."

So the correct representation is condition is to use the never type as the return type.

As for whenever it's correct for it to be UB, I think it is, as least for C/C++, n2764 (couldn't find a more recent draft) clear states that:

If a function is declared with the noreturn attribute in one translation unit and the same function is declared without the noreturn attribute in another translation unit, the behavior is undefined.

musl defines exit with the _Noreturn attribute (same attribute but for C).

I don't know if we have such wording in Rust (at least it's not immediately obvious in Behavior considered undefined).

cc @RalfJung in case I missed something.

[hkalbasi]

Clearly exit should exit the program, but there is no problem in a declaration of exit which doesn't return ! and return (). It would be a weaker declaration with smaller guarantee. Similarly, I think this is not UB:

#[unsafe(no_mangle)]
fn exit() { // Note the lack of -> !
    loop {} // Or another non termination
}

Since ! and () are ABI compatible. So I think this lint for ! and () belongs to the suspicious_runtime_symbol_definitions, not invalid_runtime_symbol_definitions.

[Urgau]

there is no problem in a declaration of exit which doesn't return ! and return ().

At least in C/C++ world it doesn't look like it is (see n2764 and my previous message).

[hkalbasi]

I don't see how "The exit() function does not return." conflicts with "_noReturn is not required on the exit declaration". Are you claiming that this C23 code has UB?

void exit(int status);

int main() {
    exit(5);
}

And the standard requires the declaration to be void _Noreturn exit(int status);? I would be surprised if this is the case.

If that C code is UB free, then I expect the Rust equivalent code in the OP to be UB free too. So that code, while not ideal, is not "invalid".

[RalfJung]

Since ! and () are ABI compatible.

So there is no ABI where noreturn does any kind of shenanigans?
And even CFI treats them as compatible?
Cc @rust-lang/opsem @Darksonn

[Urgau]

I don't have access to the C standard so this may not be accurate, but from reading n2764 "Semantics 3." section, to me the answer is yes to both of your questions.

It is by the reading of n2764 UB to define exit without _Noreturn.

[RalfJung]

The C standard (more precisely, a draft that's fully identical to the standard except for legal purposes) is available in freely (and legally) online, here's the latest version.

[RalfJung]

Yeah C has lots of silly UB around declarations. But we do document () and ! as ABI-compatible and even @Jules-Bertholet's PR doesn't change that, so on the Rust side we should be able to accept this.

[Urgau]

Okay, so the declaration is fine and shouldn't be linted. What about those implementation?

#[no_mangle]
extern "C" fn exit(s: i32) {} // is this UB?

#[no_mangle]
extern "C" fn exit(s: i32) { loop{} } // what about this one?

[RalfJung]

That no_mangle is unsafe. So the first one is UB for the same reason that this is UB

#[no_mangle]
extern "C" fn write(...) -> ... { 0 }

When you define a no_mangle function with a well-known name you have to implement the contract associated with that name. This has nothing to do with the signature.

The 2nd one is not UB.