Mark extern blocks as unsafe

library/alloc/src/alloc.rs

@@ -10,7 +10,7 @@ use core::hint;
 #[cfg(not(test))]
 use core::ptr::{self, NonNull};
 
-extern "Rust" {
+unsafe extern "Rust" {
     // These are the magic symbols to call the global allocator. rustc generates
     // them to call `__rg_alloc` etc. if there is a `#[global_allocator]` attribute
     // (the code expanding that attribute macro generates those functions), or to call
@@ -355,7 +355,7 @@ unsafe fn exchange_malloc(size: usize, align: usize) -> *mut u8 {
 // # Allocation error handler
 
 #[cfg(not(no_global_oom_handling))]
-extern "Rust" {
+unsafe extern "Rust" {
     // This is the magic symbol to call the global alloc error handler. rustc generates
     // it to call `__rg_oom` if there is a `#[alloc_error_handler]`, or to call the
     // default implementations below (`__rdl_oom`) otherwise.
@@ -426,7 +426,7 @@ pub mod __alloc_error_handler {
     // `#[alloc_error_handler]`.
     #[rustc_std_internal_symbol]
     pub unsafe fn __rdl_oom(size: usize, _align: usize) -> ! {
-        extern "Rust" {
+        unsafe extern "Rust" {
             // This symbol is emitted by rustc next to __rust_alloc_error_handler.
             // Its value depends on the -Zoom={panic,abort} compiler option.
             static __rust_alloc_error_handler_should_panic: u8;

library/alloc/src/ffi/c_str.rs

@@ -397,7 +397,7 @@ impl CString {
         // information about the size of the allocation is correct on Rust's
         // side.
         unsafe {
-            extern "C" {
+            unsafe extern "C" {
                 /// Provided by libc or compiler_builtins.
                 fn strlen(s: *const c_char) -> usize;
             }

library/core/src/ffi/c_str.rs

@@ -731,7 +731,7 @@ const unsafe fn strlen(ptr: *const c_char) -> usize {
 
             len
         } else {
-            extern "C" {
+            unsafe extern "C" {
                 /// Provided by libc or compiler_builtins.
                 fn strlen(s: *const c_char) -> usize;
             }

library/core/src/ffi/mod.rs

@@ -90,4 +90,4 @@ impl fmt::Debug for c_void {
     cfg(not(target_feature = "crt-static"))
 )]
 #[link(name = "/defaultlib:libcmt", modifiers = "+verbatim", cfg(target_feature = "crt-static"))]
-extern "C" {}
+unsafe extern "C" {}

library/core/src/intrinsics/mod.rs

@@ -4855,7 +4855,7 @@ pub const unsafe fn copysignf128(_x: f128, _y: f128) -> f128 {
 #[cfg(miri)]
 #[rustc_allow_const_fn_unstable(const_eval_select)]
 pub(crate) const fn miri_promise_symbolic_alignment(ptr: *const (), align: usize) {
-    extern "Rust" {
+    unsafe extern "Rust" {
         /// Miri-provided extern function to promise that a given pointer is properly aligned for
         /// "symbolic" alignment checks. Will fail if the pointer is not actually aligned or `align` is
         /// not a power of two. Has no effect when alignment checks are concrete (which is the default).

library/core/src/panicking.rs

@@ -59,7 +59,7 @@ pub const fn panic_fmt(fmt: fmt::Arguments<'_>) -> ! {
 
     // NOTE This function never crosses the FFI boundary; it's a Rust-to-Rust call
     // that gets resolved to the `#[panic_handler]` function.
-    extern "Rust" {
+    unsafe extern "Rust" {
         #[lang = "panic_impl"]
         fn panic_impl(pi: &PanicInfo<'_>) -> !;
     }
@@ -100,7 +100,7 @@ pub const fn panic_nounwind_fmt(fmt: fmt::Arguments<'_>, force_no_backtrace: boo
 
             // NOTE This function never crosses the FFI boundary; it's a Rust-to-Rust call
             // that gets resolved to the `#[panic_handler]` function.
-            extern "Rust" {
+            unsafe extern "Rust" {
                 #[lang = "panic_impl"]
                 fn panic_impl(pi: &PanicInfo<'_>) -> !;
             }

library/core/src/ptr/metadata.rs

@@ -155,7 +155,7 @@ pub struct DynMetadata<Dyn: ?Sized> {
     _phantom: crate::marker::PhantomData<Dyn>,
 }
 
-extern "C" {
+unsafe extern "C" {
     /// Opaque type for accessing vtables.
     ///
     /// Private implementation detail of `DynMetadata::size_of` etc.

library/coretests/tests/mem.rs

@@ -648,7 +648,7 @@ fn offset_of_dst() {
         z: dyn Trait,
     }
 
-    extern "C" {
+    unsafe extern "C" {
         type Extern;
     }
 

library/coretests/tests/num/flt2dec/mod.rs

@@ -80,7 +80,7 @@ fn ldexp_f32(a: f32, b: i32) -> f32 {
 }
 
 fn ldexp_f64(a: f64, b: i32) -> f64 {
-    extern "C" {
+    unsafe extern "C" {
         fn ldexp(x: f64, n: i32) -> f64;
     }
     // SAFETY: assuming a correct `ldexp` has been supplied, the given arguments cannot possibly

library/coretests/tests/ptr.rs

@@ -97,7 +97,7 @@ fn test_is_null() {
     let nmi: *mut dyn ToString = null_mut::<isize>();
     assert!(nmi.is_null());
 
-    extern "C" {
+    unsafe extern "C" {
         type Extern;
     }
     let ec: *const Extern = null::<Extern>();
@@ -308,7 +308,7 @@ fn test_const_nonnull_new() {
 pub fn test_variadic_fnptr() {
     use core::ffi;
     use core::hash::{Hash, SipHasher};
-    extern "C" {
+    unsafe extern "C" {
         // This needs to use the correct function signature even though it isn't called as some
         // codegen backends make it UB to declare a function with multiple conflicting signatures
         // (like LLVM) while others straight up return an error (like Cranelift).
@@ -506,7 +506,7 @@ fn offset_from() {
 fn ptr_metadata() {
     struct Unit;
     struct Pair<A, B: ?Sized>(A, B);
-    extern "C" {
+    unsafe extern "C" {
         type Extern;
     }
     let () = metadata(&());

library/panic_abort/src/lib.rs

@@ -54,7 +54,7 @@ pub unsafe fn __rust_start_panic(_payload: &mut dyn PanicPayload) -> u32 {
         ))] {
             unsafe fn abort() -> ! {
                 // call std::sys::abort_internal
-                extern "C" {
+                unsafe extern "C" {
                     pub fn __rust_abort() -> !;
                 }
                 __rust_abort();
@@ -87,7 +87,7 @@ pub unsafe fn __rust_start_panic(_payload: &mut dyn PanicPayload) -> u32 {
             }
         } else if #[cfg(target_os = "teeos")] {
             mod teeos {
-                extern "C" {
+                unsafe extern "C" {
                     pub fn TEE_Panic(code: u32) -> !;
                 }
             }

library/panic_abort/src/zkvm.rs

@@ -16,7 +16,7 @@ pub(crate) unsafe fn zkvm_set_abort_message(payload: &mut dyn PanicPayload) {
         return;
     }
 
-    extern "C" {
+    unsafe extern "C" {
         fn sys_panic(msg_ptr: *const u8, len: usize) -> !;
     }
 

library/panic_unwind/src/emcc.rs

@@ -21,7 +21,7 @@ struct TypeInfo {
 }
 unsafe impl Sync for TypeInfo {}
 
-extern "C" {
+unsafe extern "C" {
     // The leading `\x01` byte here is actually a magical signal to LLVM to
     // *not* apply any other mangling like prefixing with a `_` character.
     //
@@ -116,7 +116,7 @@ extern "C" fn exception_cleanup(ptr: *mut libc::c_void) -> *mut libc::c_void {
     }
 }
 
-extern "C" {
+unsafe extern "C" {
     fn __cxa_allocate_exception(thrown_size: libc::size_t) -> *mut libc::c_void;
     fn __cxa_begin_catch(thrown_exception: *mut libc::c_void) -> *mut libc::c_void;
     fn __cxa_end_catch();

library/panic_unwind/src/hermit.rs

@@ -6,14 +6,14 @@ use alloc::boxed::Box;
 use core::any::Any;
 
 pub(crate) unsafe fn cleanup(_ptr: *mut u8) -> Box<dyn Any + Send> {
-    extern "C" {
+    unsafe extern "C" {
         fn __rust_abort() -> !;
     }
     __rust_abort();
 }
 
 pub(crate) unsafe fn panic(_data: Box<dyn Any + Send>) -> u32 {
-    extern "C" {
+    unsafe extern "C" {
         fn __rust_abort() -> !;
     }
     __rust_abort();

library/panic_unwind/src/lib.rs

@@ -75,7 +75,7 @@ cfg_if::cfg_if! {
     }
 }
 
-extern "C" {
+unsafe extern "C" {
     /// Handler in std called when a panic object is dropped outside of
     /// `catch_unwind`.
     fn __rust_drop_panic() -> !;

library/panic_unwind/src/miri.rs

@@ -7,7 +7,7 @@ use core::any::Any;
 // Must be pointer-sized.
 type Payload = Box<Box<dyn Any + Send>>;
 
-extern "Rust" {
+unsafe extern "Rust" {
     /// Miri-provided extern function to begin unwinding.
     fn miri_start_unwind(payload: *mut u8) -> !;
 }

library/panic_unwind/src/seh.rs

@@ -135,7 +135,7 @@ mod imp {
     #[derive(Copy, Clone)]
     pub(super) struct ptr_t(u32);
 
-    extern "C" {
+    unsafe extern "C" {
         static __ImageBase: u8;
     }
 
@@ -229,7 +229,7 @@ static mut CATCHABLE_TYPE: _CatchableType = _CatchableType {
     copyFunction: ptr_t::null(),
 };
 
-extern "C" {
+unsafe extern "C" {
     // The leading `\x01` byte here is actually a magical signal to LLVM to
     // *not* apply any other mangling like prefixing with a `_` character.
     //
@@ -343,7 +343,7 @@ pub(crate) unsafe fn panic(data: Box<dyn Any + Send>) -> u32 {
         ptr_t::new(exception_copy as *mut u8).raw(),
     );
 
-    extern "system-unwind" {
+    unsafe extern "system-unwind" {
         fn _CxxThrowException(pExceptionObject: *mut c_void, pThrowInfo: *mut u8) -> !;
     }
 

library/rtstartup/rsbegin.rs

@@ -76,7 +76,7 @@ pub mod eh_frames {
     }
 
     // Unwind info registration/deregistration routines.
-    extern "C" {
+    unsafe extern "C" {
         fn __register_frame_info(eh_frame_begin: *const u8, object: *mut u8);
         fn __deregister_frame_info(eh_frame_begin: *const u8, object: *mut u8);
     }

library/std/src/alloc.rs

@@ -345,7 +345,7 @@ pub fn take_alloc_error_hook() -> fn(Layout) {
 }
 
 fn default_alloc_error_hook(layout: Layout) {
-    extern "Rust" {
+    unsafe extern "Rust" {
         // This symbol is emitted by rustc next to __rust_alloc_error_handler.
         // Its value depends on the -Zoom={panic,abort} compiler option.
         static __rust_alloc_error_handler_should_panic: u8;

library/std/src/panicking.rs

@@ -54,11 +54,11 @@ pub static EMPTY_PANIC: fn(&'static str) -> ! =
 // One day this may look a little less ad-hoc with the compiler helping out to
 // hook up these functions, but it is not this day!
 #[allow(improper_ctypes)]
-extern "C" {
+unsafe extern "C" {
     fn __rust_panic_cleanup(payload: *mut u8) -> *mut (dyn Any + Send + 'static);
 }
 
-extern "Rust" {
+unsafe extern "Rust" {
     /// `PanicPayload` lazily performs allocation only when needed (this avoids
     /// allocations when using the "abort" panic runtime).
     fn __rust_start_panic(payload: &mut dyn PanicPayload) -> u32;

library/std/src/sys/alloc/xous.rs

@@ -8,7 +8,7 @@ use crate::alloc::{GlobalAlloc, Layout, System};
 static mut DLMALLOC: dlmalloc::Dlmalloc = dlmalloc::Dlmalloc::new();
 
 #[cfg(test)]
-extern "Rust" {
+unsafe extern "Rust" {
     #[link_name = "_ZN16__rust_internals3std3sys4xous5alloc8DLMALLOCE"]
     static mut DLMALLOC: dlmalloc::Dlmalloc;
 }

library/std/src/sys/cmath.rs

@@ -2,7 +2,7 @@
 
 // These symbols are all defined by `libm`,
 // or by `compiler-builtins` on unsupported platforms.
-extern "C" {
+unsafe extern "C" {
     pub fn acos(n: f64) -> f64;
     pub fn asin(n: f64) -> f64;
     pub fn atan(n: f64) -> f64;

library/std/src/sys/pal/hermit/mod.rs

@@ -78,7 +78,7 @@ pub unsafe extern "C" fn runtime_entry(
     argv: *const *const c_char,
     env: *const *const c_char,
 ) -> ! {
-    extern "C" {
+    unsafe extern "C" {
         fn main(argc: isize, argv: *const *const c_char) -> i32;
     }
 

library/std/src/sys/pal/itron/abi.rs

@@ -132,7 +132,7 @@ pub struct T_CTSK {
     pub stk: *mut u8,
 }
 
-extern "C" {
+unsafe extern "C" {
     #[link_name = "__asp3_acre_tsk"]
     pub fn acre_tsk(pk_ctsk: *const T_CTSK) -> ER_ID;
     #[link_name = "__asp3_get_tid"]

library/std/src/sys/pal/sgx/abi/mem.rs

@@ -12,7 +12,7 @@ pub(crate) unsafe fn rel_ptr_mut<T>(offset: u64) -> *mut T {
     (image_base() + offset) as *mut T
 }
 
-extern "C" {
+unsafe extern "C" {
     static ENCLAVE_SIZE: usize;
     static HEAP_BASE: u64;
     static HEAP_SIZE: usize;

library/std/src/sys/pal/sgx/abi/mod.rs

@@ -73,7 +73,7 @@ extern "C" fn entry(p1: u64, p2: u64, p3: u64, secondary: bool, p4: u64, p5: u64
 
         EntryReturn(0, 0)
     } else {
-        extern "C" {
+        unsafe extern "C" {
             fn main(argc: isize, argv: *const *const u8) -> isize;
         }
 

library/std/src/sys/pal/sgx/abi/panic.rs

@@ -2,7 +2,7 @@ use super::usercalls::alloc::UserRef;
 use crate::io::{self, Write};
 use crate::{cmp, mem};
 
-extern "C" {
+unsafe extern "C" {
     fn take_debug_panic_buf_ptr() -> *mut u8;
     static DEBUG: u8;
 }

library/std/src/sys/pal/sgx/abi/reloc.rs

@@ -11,7 +11,7 @@ struct Rela<T> {
 }
 
 pub fn relocate_elf_rela() {
-    extern "C" {
+    unsafe extern "C" {
         static RELA: u64;
         static RELACOUNT: usize;
     }

library/std/src/sys/pal/sgx/abi/thread.rs

@@ -6,7 +6,7 @@ use fortanix_sgx_abi::Tcs;
 /// is a one-to-one correspondence of the ID to the address of the TCS.
 #[unstable(feature = "sgx_platform", issue = "56975")]
 pub fn current() -> Tcs {
-    extern "C" {
+    unsafe extern "C" {
         fn get_tcs_addr() -> *mut u8;
     }
     let addr = unsafe { get_tcs_addr() };

library/std/src/sys/pal/sgx/abi/tls/mod.rs

@@ -22,7 +22,7 @@ macro_rules! dup {
 #[export_name = "_ZN16__rust_internals3std3sys3sgx3abi3tls14TLS_DESTRUCTORE"]
 static TLS_DESTRUCTOR: [AtomicUsize; TLS_KEYS] = dup!((* * * * * * *) (AtomicUsize::new(0)));
 
-extern "C" {
+unsafe extern "C" {
     fn get_tls_ptr() -> *const u8;
     fn set_tls_ptr(tls: *const u8);
 }

library/std/src/sys/pal/sgx/abi/usercalls/raw.rs

@@ -9,7 +9,7 @@ use crate::ptr::NonNull;
 #[repr(C)]
 struct UsercallReturn(u64, u64);
 
-extern "C" {
+unsafe extern "C" {
     fn usercall(nr: NonZero<u64>, p1: u64, p2: u64, abort: u64, p3: u64, p4: u64)
     -> UsercallReturn;
 }

library/std/src/sys/pal/solid/abi/fs.rs

@@ -31,7 +31,7 @@ pub const DT_WHT: c_uchar = 14;
 
 pub type S_DIR = c_int;
 
-extern "C" {
+unsafe extern "C" {
     pub fn SOLID_FS_Open(fd: *mut c_int, path: *const c_char, mode: c_int) -> c_int;
     pub fn SOLID_FS_Close(fd: c_int) -> c_int;
     pub fn SOLID_FS_Read(fd: c_int, buf: *mut u8, size: usize, result: *mut usize) -> c_int;