using extern "x86-interrupt" + #[naked] + kernel address sanitizer crashes compiler

[Freax13]

I tried this code:

#![no_std]
#![feature(abi_x86_interrupt)]
#![feature(naked_functions)]

#[naked]
pub extern "x86-interrupt" fn page_fault_handler(_: u64, _: u64) {
    unsafe {
        core::arch::asm!("ud2", options(noreturn));
    }
}

And compiled it with --target x86_64-unknown-none -Zsanitizer=kernel-address.

I expected to see this happen: The compiler should generate a function page_fault_handler which only contains the ud2 instruction.

Instead, this happened: The compiler crashes with SIGILL.

Meta

rustc --version --verbose:

rustc 1.82.0-nightly (506052d49 2024-08-16)
binary: rustc
commit-hash: 506052d49d3903ea554e4ce760cc53610cff4ef5
commit-date: 2024-08-16
host: x86_64-unknown-linux-gnu
release: 1.82.0-nightly
LLVM version: 19.1.0

As requested in #127853 (comment).

[saethlin]

This is an LLVM assertion

UNREACHABLE executed at /checkout/src/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp:1959!

[tgross35]

It was noted in #127853 (comment) that this comes from sanitizer annotations being added to naked functions. Seems like we might not want to do that? Cc @rust-lang/project-exploit-mitigations

[workingjubilee]

Almost certainly, but llvm_unreachable is not supposed to be used in places where user input can cause it to be reached.

[workingjubilee]

Reported at llvm/llvm-project#104718

[nikic]

To clarify, the fix that landed is just to make this an IR verification failure rather than a backend crash. The underlying issue with the kasan + naked combination still needs to be fixed.

[antoniofrighetto]

@nikic Should we file an issue upstream to handle this in sanitizers as well, or is there one already opened?