Fix the soundness bug in the representation of extern types

Since the very first import dafaca9 ("Initial import of liblibc"),
`libc` has used uninhabited enums to represent C's incomplete/opaque
types. While this is, as far as I know, techincally okay when working
behind raw pointers, it means that using reference types like `&FILE`
can lead to easy UB.

Resolve this by changing the representation to a `!Sync + !Send +
!Unpin` ZST, as recommended by the nomicon [1]. The loss of auto traits
technically makes this user-visible, but it is unlikely that anybody who
is doing sound things was relying on these. 

I also used this as an opportunity to add a forward-compatibility note
about intended use that should allow us to switch to real extern types
once those are available.

[1]: https://doc.rust-lang.org/nomicon/ffi.html#representing-opaque-structs

Author: tgross35

libc-test/build.rs

@@ -325,6 +325,9 @@ fn test_apple(target: &str) {
 
     cfg.skip_struct(move |s| {
         match s.ident() {
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" | "timezone" => true,
+
             // FIXME(macos): The size is changed in recent macOSes.
             "malloc_zone_t" => true,
             // it is a moving target, changing through versions
@@ -572,6 +575,15 @@ fn test_openbsd(target: &str) {
     cfg.rename_struct_ty(|ty| ty.ends_with("_t").then_some(ty.to_string()));
     cfg.rename_union_ty(|ty| ty.ends_with("_t").then_some(ty.to_string()));
 
+    cfg.skip_struct(move |struct_| {
+        match struct_.ident() {
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" => true,
+
+            _ => false,
+        }
+    });
+
     cfg.skip_struct_field(move |struct_, field| {
         match (struct_.ident(), field.ident()) {
             // conflicting with `p_type` macro from <resolve.h>.
@@ -693,6 +705,15 @@ fn test_cygwin(target: &str) {
         _ => false,
     });
 
+    cfg.skip_struct(move |struct_| {
+        match struct_.ident() {
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" => true,
+
+            _ => false,
+        }
+    });
+
     cfg.rename_struct_field(move |struct_, field| {
         match field.ident() {
             // Our stat *_nsec fields normally don't actually exist but are part
@@ -828,6 +849,8 @@ fn test_windows(target: &str) {
         match struct_.ident() {
             // FIXME(windows): The size and alignment of this struct are incorrect
             "timespec" if gnu && i686 => true,
+            // Extern types
+            "FILE" | "fpos_t" | "timezone" => true,
             _ => false,
         }
     });
@@ -1089,13 +1112,16 @@ fn test_solarish(target: &str) {
         false
     });
     cfg.skip_struct(move |struct_| {
-        // the union handling is a mess
-        if struct_.ident().contains("door_desc_t_") {
-            return true;
-        }
         match struct_.ident() {
+            // the union handling is a mess
+            x if x.contains("door_desc_t_") => true,
+
             // a bunch of solaris-only fields
             "utmpx" if is_illumos => true,
+
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" | "timezone" | "ucred_t" => true,
+
             _ => false,
         }
     });
@@ -1362,6 +1388,8 @@ fn test_netbsd(target: &str) {
             "ptrace_lwpinfo" => true,
             // ABI change in NetBSD10, with symbol versioning.
             "statvfs" if !netbsd9 => true,
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" | "timezone" | "_cpuset" | "sem" => true,
             _ => false,
         }
     });
@@ -1647,6 +1675,9 @@ fn test_dragonflybsd(target: &str) {
             // structs.
             "termios2" => true,
 
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" => true,
+
             _ => false,
         }
     });
@@ -1793,6 +1824,14 @@ fn test_wasi(target: &str) {
         _ => false,
     });
 
+    cfg.skip_struct(move |struct_| {
+        match struct_.ident() {
+            // Extern types
+            "DIR" | "FILE" | "__locale_struct" => true,
+            _ => false,
+        }
+    });
+
     cfg.skip_fn(|f| match f.ident() {
         // This function doesn't actually exist in libc's header files
         "__errno_location" => true,
@@ -2041,6 +2080,9 @@ fn test_android(target: &str) {
             // FIXME(android): The field has been changed:
             "sockaddr_vm" => true,
 
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" | "timezone" => true,
+
             _ => false,
         }
     });
@@ -2846,6 +2888,9 @@ fn test_freebsd(target: &str) {
             // Those are introduced in FreeBSD 15.
             "xktls_session_onedir" | "xktls_session" if Some(15) > freebsd_ver => true,
 
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" | "timezone" => true,
+
             _ => false,
         }
     });
@@ -3144,6 +3189,9 @@ fn test_emscripten(target: &str) {
             "pthread_condattr_t" => true,
             "pthread_mutexattr_t" => true,
 
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" | "fpos64_t" | "timezone" => true,
+
             // No epoll support
             // https://github.com/emscripten-core/emscripten/issues/5033
             ty if ty.starts_with("epoll") => true,
@@ -3424,6 +3472,9 @@ fn test_neutrino(target: &str) {
             // union
             "_channel_connect_attr" => true,
 
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" => true,
+
             _ => false,
         }
     });
@@ -4221,9 +4272,10 @@ fn test_linux(target: &str) {
             // On 64 bits the size did not change, skip only for 32 bits.
             "ptrace_syscall_info" if pointer_width == 32 => true,
 
+            // not in sys/fanotify.h in uclibc
+            "fanotify_event_info_header" | "fanotify_event_info_fid" if uclibc => true,
+
             "canxl_frame"
-            | "fanotify_event_info_header" // not in sys/fanotify.h in uclibc
-            | "fanotify_event_info_fid"  // not in sys/fanotify.h in uclibc
             | "tls12_crypto_info_sm4_gcm"
             | "tls12_crypto_info_sm4_ccm"
             | "tls12_crypto_info_aria_gcm_128"
@@ -4233,6 +4285,9 @@ fn test_linux(target: &str) {
                 true
             }
 
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" | "timezone" => true,
+
             _ => false,
         }
     });
@@ -5734,6 +5789,9 @@ fn test_aix(target: &str) {
             // header.
             "fileops_t" | "file" => true,
 
+            // Extern types
+            "DIR" | "FILE" | "fpos_t" => true,
+
             _ => false,
         }
     });

src/fuchsia/mod.rs

@@ -79,9 +79,9 @@ pub type fsfilcnt_t = c_ulonglong;
 pub type rlim_t = c_ulonglong;
 
 extern_ty! {
-    pub enum timezone {}
-    pub enum DIR {}
-    pub enum fpos64_t {} // FIXME(fuchsia): fill this out with a struct
+    pub type timezone;
+    pub type DIR;
+    pub type fpos64_t; // FIXME(fuchsia): fill this out with a struct
 }
 
 // PUB_STRUCT
@@ -3188,8 +3188,8 @@ fn __MHDR_END(mhdr: *const msghdr) -> *mut c_uchar {
 extern "C" {}
 
 extern_ty! {
-    pub enum FILE {}
-    pub enum fpos_t {} // FIXME(fuchsia): fill this out with a struct
+    pub type FILE;
+    pub type fpos_t; // FIXME(fuchsia): fill this out with a struct
 }
 
 extern "C" {

src/macros.rs

@@ -246,17 +246,36 @@ macro_rules! s_no_extra_traits {
 macro_rules! extern_ty {
     ($(
         $(#[$attr:meta])*
-        pub enum $i:ident {}
+        pub type $i:ident;
     )*) => ($(
         $(#[$attr])*
-        // FIXME(1.0): the type is uninhabited so these traits are unreachable and could be
-        // removed.
+        /// This is an extern type ("opaque" or "incomplete" type in C).
+        ///
+        /// <div class="warning">
+        /// This type's current representation allows inspecting some properties, such as via
+        /// <code>size_of</code>, and it is technically possible to construct the type within
+        /// <code>MaybeUninit</code>, However, this <strong>MUST NOT</strong> be relied upon
+        /// because a future version of <code>libc</code> may switch to a proper
+        /// <a href="https://rust-lang.github.io/rfcs/1861-extern-types.html">extern type</a>
+        /// representation when available.
+        /// </div>
+        // ^ unfortunately warning blocks currently don't render markdown so we need to
+        // use raw HTML.
+        //
+        // Representation based on the Nomicon:
+        // <https://doc.rust-lang.org/nomicon/ffi.html#representing-opaque-structs>.
+        //
+        // FIXME(1.0): These traits are unreachable and should be removed.
         #[::core::prelude::v1::derive(
             ::core::clone::Clone,
             ::core::marker::Copy,
             ::core::fmt::Debug,
         )]
-        pub enum $i { }
+        #[repr(C)]
+        pub struct $i {
+            _data: (),
+            _marker: ::core::marker::PhantomData<(*mut u8, ::core::marker::PhantomPinned)>,
+        }
     )*);
 }
 

src/new/qurt/mod.rs

@@ -63,7 +63,7 @@ pub type in_port_t = c_ushort;
 
 // Standard C library types
 extern_ty! {
-    pub enum FILE {}
+    pub type FILE;
 }
 pub type fpos_t = c_long;
 pub type clock_t = c_long;

src/solid/mod.rs

@@ -397,8 +397,8 @@ pub const SIGUSR2: c_int = 31;
 pub const SIGPWR: c_int = 32;
 
 extern_ty! {
-    pub enum FILE {}
-    pub enum fpos_t {}
+    pub type FILE;
+    pub type fpos_t;
 }
 
 extern "C" {

src/unix/aix/powerpc64.rs

@@ -3,7 +3,7 @@ use crate::prelude::*;
 
 // Define lock_data_instrumented as an empty enum
 extern_ty! {
-    pub enum lock_data_instrumented {}
+    pub type lock_data_instrumented;
 }
 
 s! {

src/unix/bsd/apple/mod.rs

@@ -176,7 +176,7 @@ pub type attrgroup_t = u32;
 pub type vol_capabilities_set_t = [u32; 4];
 
 extern_ty! {
-    pub enum timezone {}
+    pub type timezone;
 }
 
 c_enum! {

src/unix/bsd/freebsdlike/dragonfly/mod.rs

@@ -49,7 +49,7 @@ pub type vm_map_entry_t = *mut vm_map_entry;
 pub type pmap = __c_anonymous_pmap;
 
 extern_ty! {
-    pub enum sem {}
+    pub type sem;
 }
 
 c_enum! {

src/unix/bsd/freebsdlike/mod.rs

@@ -60,7 +60,7 @@ cfg_if! {
 // link.h
 
 extern_ty! {
-    pub enum timezone {}
+    pub type timezone;
 }
 
 impl siginfo_t {

src/unix/bsd/netbsdlike/mod.rs

@@ -17,8 +17,8 @@ pub type sem_t = *mut sem;
 pub type key_t = c_long;
 
 extern_ty! {
-    pub enum timezone {}
-    pub enum sem {}
+    pub type timezone;
+    pub type sem;
 }
 
 s! {