Re: UBSAN whinge in ihci-hub.c

From	Andrey Ryabinin <ryabinin.a.a@gmail.com>
Newsgroups	linux.kernel
Subject	Re: UBSAN whinge in ihci-hub.c
Date	2016-05-18 14:30 +0200
Message-ID	<rA8LU-25R-37@gated-at.bofh.it> (permalink)
References	(1 earlier) <rzVvk-1Vr-9@gated-at.bofh.it> <rA4oW-7vr-31@gated-at.bofh.it> <rA51E-7Zz-23@gated-at.bofh.it> <rA5O1-5S-7@gated-at.bofh.it> <rA6TM-Pd-25@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

2016-05-18 13:19 GMT+03:00 Oliver Neukum <oneukum@suse.com>:
> On Wed, 2016-05-18 at 12:16 +0300, Andrey Ryabinin wrote:
>> 2016-05-18 11:18 GMT+03:00 Oliver Neukum <oneukum@suse.com>:
>> > On Wed, 2016-05-18 at 10:40 +0300, Andrey Ryabinin wrote:
>> >> 2016-05-18 1:16 GMT+03:00 Greg Kroah-Hartman <gregkh@linuxfoundation.org>:
>> >> > On Tue, May 17, 2016 at 05:52:40PM -0400, Valdis Kletnieks wrote:
>> >> >> So, not content in the amount of breakage I generate already, I
>> >> >> compiled with UBSAN enabled...
>> >> >>
>> >> >> The immediately relevant part:
>> >> >>
>> >> >> [    2.418576] ================================================================================
>> >> >> [    2.418579] UBSAN: Undefined behaviour in drivers/usb/host/ehci-hub.c:877:47
>> >> >> [    2.418582] index -1 is out of range for type 'u32 [1]'
>> >> >
>> >> > <snip>
>> >> >
>> >> > It's a known bug in ubsan,
>> >>
>> >> It's not a bug.  int *p = &a[-1] is undefined behavior. It doesn't
>> >> matter whether that pointer dereferenced or not.
>> >
>> > That is a bold statement. Pointer arithmetic is defined. How can
>> > the computation of an address be undefined behavior while it is
>> > not used?
>>
>> It's defined only if pointer points to array element or one-past-end
>> element. Everything else is undefined.
>>
>> $ 6.5.6.8
>>    "If both the pointer operand and the result point to elements of
>> the same array object,
>>      or one past the last element of the array object, the evaluation
>> shall not produce an overflow;
>>      otherwise, the behavior is undefined."
>
> But we do not care whether the calculation overflows. We don't use it
> at all in those cases.
>

This doesn't make it defined. Also that pointer is unused only if gcc
doesn't optimize away '!wIndex' check.
If it does,  we may actually use it.

Thread

UBSAN whinge in ihci-hub.c Valdis Kletnieks <Valdis.Kletnieks@vt.edu> - 2016-05-18 00:00 +0200
  Re: UBSAN whinge in ihci-hub.c Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-18 00:20 +0200
    Re: UBSAN whinge in ihci-hub.c Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2016-05-18 09:50 +0200
      Re: UBSAN whinge in ihci-hub.c Oliver Neukum <oneukum@suse.com> - 2016-05-18 10:30 +0200
        Re: UBSAN whinge in ihci-hub.c Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2016-05-18 11:20 +0200
          Re: UBSAN whinge in ihci-hub.c Oliver Neukum <oneukum@suse.com> - 2016-05-18 12:30 +0200
            Re: UBSAN whinge in ihci-hub.c Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2016-05-18 14:30 +0200
              Re: UBSAN whinge in ihci-hub.c Alan Stern <stern@rowland.harvard.edu> - 2016-05-18 16:50 +0200
                Re: UBSAN whinge in ihci-hub.c Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2016-05-18 17:10 +0200
                Re: UBSAN whinge in ihci-hub.c Alan Stern <stern@rowland.harvard.edu> - 2016-05-18 18:10 +0200
                Re: UBSAN whinge in ihci-hub.c Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2016-05-18 19:20 +0200
                Re: UBSAN whinge in ihci-hub.c Alan Stern <stern@rowland.harvard.edu> - 2016-05-18 21:30 +0200
                Re: UBSAN whinge in ihci-hub.c Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2016-05-19 18:30 +0200
                Re: UBSAN whinge in ihci-hub.c Alan Stern <stern@rowland.harvard.edu> - 2016-05-19 22:20 +0200
              RE: UBSAN whinge in ihci-hub.c David Laight <David.Laight@ACULAB.COM> - 2016-05-23 18:10 +0200

csiph-web