一句话：通过 Miri 与 LLVM 解释器联合执行，大规模评估 Rust 库跨 FFI 边界调用中的未定义行为。
Rust 依赖静态安全保证，但其与其他语言互操作时，外部代码的模式可能与不断演进的别名模型冲突。Miri 是唯一能按这些模型验证应用的动态分析工具，却不支持检查外部函数，形成正确性缺口。本文对调用外部函数的 Rust 库进行大规模评估，将 Miri 与 LLVM 解释器联合执行跨语言应用。结果在 37 个库中发现 46 处未定义或不期望行为，其中 3 个库平均日下载量超过 1 万，1 个由 Rust 项目维护；许多问题违反别名模型，且 Tree Borrows 比 Stacked Borrows 明显更宽松。作者呼吁社区投资多语言应用的生产级工具。
Developers rely on the static safety guarantees of the Rust programming language to write secure and performant applications. However, Rust is frequently used to interoperate with other languages which allow design patterns that conflict with Rust's evolving aliasing models. Miri is currently the only dynamic analysis tool that can validate applications against these models, but it does not support finding bugs in foreign functions, indicating that there may be a critical correctness gap across the Rust ecosystem. We conducted a large-scale evaluation of Rust libraries that call foreign functions to determine whether Miri's dynamic analyses remain useful in this context. We used Miri and an LLVM interpreter to jointly execute applications that call foreign functions, where we found 46 instances of undefined or undesired behavior in 37 libraries. Three bugs were found in libraries that had more than 10,000 daily downloads on average during our observation period, and one was found in a library maintained by the Rust Project. Many of these bugs were violations of Rust's aliasing models, but the latest Tree Borrows model was significantly more permissive than the earlier Stacked Borrows model. The Rust community must invest in new, production-ready tooling for multi-language applications to ensure that developers can detect these errors.
DOI 原文 ·
@inproceedings{paperbot8836,
title = {A Study of Undefined Behavior Across Foreign Function Boundaries in Rust Libraries},
author = {Ian McCormack and Joshua Sunshine and Jonathan Aldrich},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00167}
}