[PATCH v1] rust: compiler_builtins: Fix silent trap in prohibited intrinsics

[PATCH v1] rust: compiler_builtins: Fix silent trap in prohibited intrinsics

[FUJITA Tomonori]

From: FUJITA Tomonori <fujita.tomonori@gmail.com>

When core calls one of the stubs for builtins that should not be used,
the stub runs a trap instruction that prints no message, and the Oops
shows a wrong name. For example, when __rust__udivti3() is called on
x86_64, the Oops shows:

  Oops: invalid opcode: 0000 [#1] SMP
  RIP: 0010:__rust__adddf3+0x0/0x10

The stubs call panic!(), but since Rust 1.79, rustc does not allow code
in a `#![compiler_builtins]` crate to link to functions in other crates,
and it silently turns such calls that do not return into a trap [1]. In
addition, all the stubs have the same code, so LLVM merges them into one
function.

Replace panic!() with _printk() and BUG(), as the panic handler in the
kernel crate does. These are C functions, and rustc allows calls to
them. Each stub passes its own name to _printk(), so the stubs are no
longer merged:

  __udivti3 called: `u128` should not be used
  kernel BUG at rust/helpers/bug.c:7!

Link: https://github.com/rust-lang/rust/pull/122580 [1]
Assisted-by: LLM
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
---
Another option to fix this is moving the stubs to a normal crate (not
`#![compiler_builtins]`), so that panic!() works as usual.
---
 rust/compiler_builtins.rs | 39 ++++++++++++++++++++++++++++++++++++---
 1 file changed, 36 insertions(+), 3 deletions(-)

diff --git a/rust/compiler_builtins.rs b/rust/compiler_builtins.rs
index fc6b54636dd5..9416ca4c23f5 100644
--- a/rust/compiler_builtins.rs
+++ b/rust/compiler_builtins.rs
@@ -9,8 +9,8 @@
 //! At the moment, some builtins are required that should not be. For instance,
 //! [`core`] has 128-bit integers functionality which we should not be compiling
 //! in. We will work with upstream [`core`] to provide feature flags to disable
-//! the parts we do not need. For the moment, we define them to [`panic!`] at
-//! runtime for simplicity to catch mistakes, instead of performing surgery
+//! the parts we do not need. For the moment, we define them to print an error
+//! and call `BUG()` at runtime to catch mistakes, instead of performing surgery
 //! on `core.o`.
 //!
 //! In any case, all these symbols are weakened to ensure we do not override
@@ -25,13 +25,46 @@
 #![no_builtins]
 #![no_std]
 
+unsafe extern "C" {
+    #[cfg(CONFIG_PRINTK)]
+    fn _printk(fmt: *const u8, ...) -> core::ffi::c_int;
+    fn rust_helper_BUG() -> !;
+}
+
+// In a `#![compiler_builtins]` crate, code cannot link to functions in other
+// crates. `rustc` rejects such calls, except that it silently turns the ones
+// that do not return (e.g. `panic!`) into a trap.
+#[cold]
+#[inline(never)]
+#[cfg_attr(not(CONFIG_PRINTK), allow(unused_variables))]
+fn intrinsic_called(name: &str, reason: &str) -> ! {
+    #[cfg(CONFIG_PRINTK)]
+    // SAFETY: The format string is NUL-terminated. Each `%.*s` takes a
+    // `c_int` length and a pointer. `name.as_ptr()` is valid for reads of
+    // `name.len()` bytes, and so is `reason.as_ptr()` for `reason.len()`
+    // bytes.
+    unsafe {
+        _printk(
+            // "\x010" is `KERN_EMERG`.
+            c"\x010%.*s called: %.*s\n".to_bytes_with_nul().as_ptr(),
+            name.len() as core::ffi::c_int,
+            name.as_ptr(),
+            reason.len() as core::ffi::c_int,
+            reason.as_ptr(),
+        )
+    };
+
+    // SAFETY: FFI call.
+    unsafe { rust_helper_BUG() }
+}
+
 macro_rules! define_panicking_intrinsics(
     ($reason: tt, { $($ident: ident, )* }) => {
         $(
             #[doc(hidden)]
             #[export_name = concat!("__rust", stringify!($ident))]
             pub extern "C" fn $ident() {
-                panic!($reason);
+                intrinsic_called(stringify!($ident), $reason)
             }
         )*
     }

base-commit: c82c75ae11fae66cf070562f9b5241a4663f30cb
-- 
2.43.0

Re: [PATCH v1] rust: compiler_builtins: Fix silent trap in prohibited intrinsics

[Gary Guo]

On Fri Oct 2, 2026 at 2:47 AM BST, FUJITA Tomonori wrote:
> From: FUJITA Tomonori <fujita.tomonori@gmail.com>
>
> When core calls one of the stubs for builtins that should not be used,
> the stub runs a trap instruction that prints no message, and the Oops
> shows a wrong name. For example, when __rust__udivti3() is called on
> x86_64, the Oops shows:
>
>   Oops: invalid opcode: 0000 [#1] SMP
>   RIP: 0010:__rust__adddf3+0x0/0x10
>
> The stubs call panic!(), but since Rust 1.79, rustc does not allow code
> in a `#![compiler_builtins]` crate to link to functions in other crates,
> and it silently turns such calls that do not return into a trap [1]. In
> addition, all the stubs have the same code, so LLVM merges them into one
> function.
>
> Replace panic!() with _printk() and BUG(), as the panic handler in the
> kernel crate does. These are C functions, and rustc allows calls to
> them. Each stub passes its own name to _printk(), so the stubs are no
> longer merged:
>
>   __udivti3 called: `u128` should not be used
>   kernel BUG at rust/helpers/bug.c:7!
>
> Link: https://github.com/rust-lang/rust/pull/122580 [1]
> Assisted-by: LLM
> Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
> ---
> Another option to fix this is moving the stubs to a normal crate (not
> `#![compiler_builtins]`), so that panic!() works as usual.

I think we should do this.

Best,
Gary

> ---
>  rust/compiler_builtins.rs | 39 ++++++++++++++++++++++++++++++++++++---
>  1 file changed, 36 insertions(+), 3 deletions(-)
>
> diff --git a/rust/compiler_builtins.rs b/rust/compiler_builtins.rs
> index fc6b54636dd5..9416ca4c23f5 100644
> --- a/rust/compiler_builtins.rs
> +++ b/rust/compiler_builtins.rs
> @@ -9,8 +9,8 @@
>  //! At the moment, some builtins are required that should not be. For instance,
>  //! [`core`] has 128-bit integers functionality which we should not be compiling
>  //! in. We will work with upstream [`core`] to provide feature flags to disable
> -//! the parts we do not need. For the moment, we define them to [`panic!`] at
> -//! runtime for simplicity to catch mistakes, instead of performing surgery
> +//! the parts we do not need. For the moment, we define them to print an error
> +//! and call `BUG()` at runtime to catch mistakes, instead of performing surgery
>  //! on `core.o`.
>  //!
>  //! In any case, all these symbols are weakened to ensure we do not override
> @@ -25,13 +25,46 @@
>  #![no_builtins]
>  #![no_std]
>  
> +unsafe extern "C" {
> +    #[cfg(CONFIG_PRINTK)]
> +    fn _printk(fmt: *const u8, ...) -> core::ffi::c_int;
> +    fn rust_helper_BUG() -> !;
> +}
> +
> +// In a `#![compiler_builtins]` crate, code cannot link to functions in other
> +// crates. `rustc` rejects such calls, except that it silently turns the ones
> +// that do not return (e.g. `panic!`) into a trap.
> +#[cold]
> +#[inline(never)]
> +#[cfg_attr(not(CONFIG_PRINTK), allow(unused_variables))]
> +fn intrinsic_called(name: &str, reason: &str) -> ! {
> +    #[cfg(CONFIG_PRINTK)]
> +    // SAFETY: The format string is NUL-terminated. Each `%.*s` takes a
> +    // `c_int` length and a pointer. `name.as_ptr()` is valid for reads of
> +    // `name.len()` bytes, and so is `reason.as_ptr()` for `reason.len()`
> +    // bytes.
> +    unsafe {
> +        _printk(
> +            // "\x010" is `KERN_EMERG`.
> +            c"\x010%.*s called: %.*s\n".to_bytes_with_nul().as_ptr(),
> +            name.len() as core::ffi::c_int,
> +            name.as_ptr(),
> +            reason.len() as core::ffi::c_int,
> +            reason.as_ptr(),
> +        )
> +    };
> +
> +    // SAFETY: FFI call.
> +    unsafe { rust_helper_BUG() }
> +}
> +
>  macro_rules! define_panicking_intrinsics(
>      ($reason: tt, { $($ident: ident, )* }) => {
>          $(
>              #[doc(hidden)]
>              #[export_name = concat!("__rust", stringify!($ident))]
>              pub extern "C" fn $ident() {
> -                panic!($reason);
> +                intrinsic_called(stringify!($ident), $reason)
>              }
>          )*
>      }
>
> base-commit: c82c75ae11fae66cf070562f9b5241a4663f30cb