Miri, Valgrind, and Sanitizers — Verifying Unsafe Code 🔴

# Install Miri (nightly-only component)rustup +nightly component add miri# Run your test suite under Miricargo +nightly miri test# Run a specific binary under Miricargo +nightly miri run# Run a specific testcargo +nightly miri test -- test_name

#[cfg(test)]
mod tests {
    #[test]
    fn test_miri_catches_ub() {
        // This "works" in release builds but is undefined behavior
        let mut v = vec![1, 2, 3];
        let ptr = v.as_ptr();

        // Push may reallocate, invalidating ptr
        v.push(4);

        // ❌ UB: ptr may be dangling after reallocation
        // Miri will catch this even if the allocator happens to
        // not move the buffer.
        // let _val = unsafe { *ptr };
        // Error: Miri would report:
        //   "pointer to alloc1234 was dereferenced after this
        //    allocation got freed"
        
        // ✅ Correct: get a fresh pointer after mutation
        let ptr = v.as_ptr();
        let val = unsafe { *ptr };
        assert_eq!(val, 1);
    }
}

# Step 1: Run all tests under Miricargo +nightly miri test 2>&1 | tee miri_output.txt# Step 2: If Miri reports errors, isolate themcargo +nightly miri test -- failing_test_name# Step 3: Use Miri's backtrace for diagnosisMIRIFLAGS="-Zmiri-backtrace=full" cargo +nightly miri test# Step 4: Choose a borrow model# Stacked Borrows (default, stricter):cargo +nightly miri test# Tree Borrows (experimental, more permissive):MIRIFLAGS="-Zmiri-tree-borrows" cargo +nightly miri test

# Disable isolation (allow file system access, env vars)MIRIFLAGS="-Zmiri-disable-isolation" cargo +nightly miri test# Memory leak detection is ON by default in Miri.# To suppress leak errors (e.g., for intentional leaks):# MIRIFLAGS="-Zmiri-ignore-leaks" cargo +nightly miri test# Seed the RNG for reproducible results with randomized testsMIRIFLAGS="-Zmiri-seed=42" cargo +nightly miri test# Enable strict provenance checkingMIRIFLAGS="-Zmiri-strict-provenance" cargo +nightly miri test# Multiple flagsMIRIFLAGS="-Zmiri-disable-isolation -Zmiri-backtrace=full -Zmiri-strict-provenance" \    cargo +nightly miri test

# .github/workflows/miri.ymlname: Mirion: [push, pull_request]jobs:  miri:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: dtolnay/rust-toolchain@nightly        with:          components: miri      - name: Run Miri        run: cargo miri test --workspace        env:          MIRIFLAGS: "-Zmiri-backtrace=full"          # Leak checking is on by default.          # Skip tests that use system calls Miri can't handle          # (file I/O, networking, etc.)

# Install Valgrindsudo apt install valgrind  # Debian/Ubuntusudo dnf install valgrind  # Fedora# Build with debug info (Valgrind needs symbols)cargo build --tests# or for release with debug info:# cargo build --release# [profile.release]# debug = true# Run a specific test binary under Valgrindvalgrind --tool=memcheck \    --leak-check=full \    --show-leak-kinds=all \    --track-origins=yes \    ./target/debug/deps/my_crate-abc123 --test-threads=1# Run the main binaryvalgrind --tool=memcheck \    --leak-check=full \    --error-exitcode=1 \    ./target/debug/diag_tool --run-diagnostics

# Record instruction counts (more stable than wall-clock time)valgrind --tool=callgrind \    --callgrind-out-file=callgrind.out \    ./target/release/diag_tool --run-diagnostics# Visualize with KCachegrindkcachegrind callgrind.out# or the text-based alternative:callgrind_annotate callgrind.out | head -100

# Required: install Rust source for rebuilding std with sanitizer instrumentationrustup component add rust-src --toolchain nightly# AddressSanitizer (ASan) — buffer overflows, use-after-free, stack overflowsRUSTFLAGS="-Zsanitizer=address" \    cargo +nightly test -Zbuild-std --target x86_64-unknown-linux-gnu# MemorySanitizer (MSan) — uninitialized memory readsRUSTFLAGS="-Zsanitizer=memory" \    cargo +nightly test -Zbuild-std --target x86_64-unknown-linux-gnu# ThreadSanitizer (TSan) — data racesRUSTFLAGS="-Zsanitizer=thread" \    cargo +nightly test -Zbuild-std --target x86_64-unknown-linux-gnu# LeakSanitizer (LSan) — memory leaks (included in ASan by default)RUSTFLAGS="-Zsanitizer=leak" \    cargo +nightly test --target x86_64-unknown-linux-gnu

use std::sync::Arc;
use std::thread;

fn racy_counter() -> u64 {
    // ❌ UB: unsynchronized shared mutable state
    let data = Arc::new(std::cell::UnsafeCell::new(0u64));
    let mut handles = vec![];

    for _ in 0..4 {
        let data = Arc::clone(&data);
        handles.push(thread::spawn(move || {
            for _ in 0..1000 {
                // SAFETY: UNSOUND — data race!
                unsafe {
                    *data.get() += 1;
                }
            }
        }));
    }

    for h in handles {
        h.join().unwrap();
    }

    // Value should be 4000 but may be anything due to race
    unsafe { *data.get() }
}

// Both Miri and TSan catch this:
// Miri:  "Data race detected between (1) write and (2) write"
// TSan:  "WARNING: ThreadSanitizer: data race"
//
// Fix: use AtomicU64 or Mutex<u64>

# Installcargo install cargo-fuzz# Initialize a fuzz targetcargo fuzz initcargo fuzz add parse_gpu_csv

// fuzz/fuzz_targets/parse_gpu_csv.rs
#![no_main]
use libfuzzer_sys::fuzz_target;

fuzz_target!(|data: &[u8]| {
    if let Ok(s) = std::str::from_utf8(data) {
        // The fuzzer generates millions of inputs looking for panics/crashes.
        let _ = diag_tool::parse_gpu_csv(s);
    }
});

# Run the fuzzer (runs until interrupted or crash found)cargo +nightly fuzz run parse_gpu_csv -- -max_total_time=300  # 5 minutes# Minimize a crashcargo +nightly fuzz tmin parse_gpu_csv artifacts/parse_gpu_csv/crash-...

[dev-dependencies]loom = "0.7"

#[cfg(loom)]
mod tests {
    use loom::sync::atomic::{AtomicUsize, Ordering};
    use loom::thread;

    #[test]
    fn test_counter_is_atomic() {
        loom::model(|| {
            let counter = loom::sync::Arc::new(AtomicUsize::new(0));
            let c1 = counter.clone();
            let c2 = counter.clone();

            let t1 = thread::spawn(move || { c1.fetch_add(1, Ordering::SeqCst); });
            let t2 = thread::spawn(move || { c2.fetch_add(1, Ordering::SeqCst); });

            t1.join().unwrap();
            t2.join().unwrap();

            // loom explores ALL possible thread interleavings
            assert_eq!(counter.load(Ordering::SeqCst), 2);
        });
    }
}

# Run all tools in parallel for fast feedbackjobs:  miri:    runs-on: ubuntu-latest    steps:      - uses: dtolnay/rust-toolchain@nightly        with: { components: miri }      - run: cargo miri test --workspace  asan:    runs-on: ubuntu-latest    steps:      - uses: dtolnay/rust-toolchain@nightly      - run: |          RUSTFLAGS="-Zsanitizer=address" \          cargo test -Zbuild-std --target x86_64-unknown-linux-gnu  valgrind:    runs-on: ubuntu-latest    steps:      - run: sudo apt-get install -y valgrind      - uses: dtolnay/rust-toolchain@stable      - run: cargo build --tests      - run: |          for test_bin in $(find target/debug/deps -maxdepth 1 -executable -type f ! -name '*.d'); do            valgrind --error-exitcode=1 --leak-check=full "$test_bin" --test-threads=1          done

# Cargo.toml — add a feature flag for unsafe optimizations[features]default = []direct-ipmi = []     # Enable direct ioctl IPMI instead of ipmitool subprocessdirect-accel-api = []     # Enable accel-mgmt FFI instead of accel-query parsing

// src/ipmi.rs — gated behind a feature flag
#[cfg(feature = "direct-ipmi")]
mod direct {
    //! Direct IPMI device access via /dev/ipmi0 ioctl.
    //!
    //! # Safety
    //! This module uses `unsafe` for ioctl system calls.
    //! Verified with: Miri (where possible), Valgrind memcheck, ASan.

    use std::os::unix::io::RawFd;

    // ... unsafe ioctl implementation ...
}

#[cfg(not(feature = "direct-ipmi"))]
mod subprocess {
    //! IPMI via ipmitool subprocess (default, fully safe).
    // ... current implementation ...
}

# Install (requires nightly, but runs your code at near-native speed)cargo install cargo-careful# Run tests with extra UB checks (catches uninitialized memory, invalid values)cargo +nightly careful test# Run a binary with extra checkscargo +nightly careful run -- --run-diagnostics