Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1683082 > unrolled thread
| Started by | Meelis Roos <mroos@linux.ee> |
|---|---|
| First post | 2017-07-07 11:40 +0200 |
| Last post | 2017-07-07 16:10 +0200 |
| Articles | 5 — 2 participants |
Back to article view | Back to linux.kernel
namei_vfat.c array subscript is above array bounds Meelis Roos <mroos@linux.ee> - 2017-07-07 11:40 +0200
Re: namei_vfat.c array subscript is above array bounds Meelis Roos <mroos@linux.ee> - 2017-07-07 16:00 +0200
Re: namei_vfat.c array subscript is above array bounds OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> - 2017-07-08 08:00 +0200
Re: namei_vfat.c array subscript is above array bounds OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> - 2017-07-08 09:50 +0200
Re: namei_vfat.c array subscript is above array bounds OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> - 2017-07-07 16:10 +0200
| From | Meelis Roos <mroos@linux.ee> |
|---|---|
| Date | 2017-07-07 11:40 +0200 |
| Subject | namei_vfat.c array subscript is above array bounds |
| Message-ID | <u0xTY-24L-17@gated-at.bofh.it> |
I do not know if this is old or new, just noticed it scrolling by while
compiling current 4.12+git on 32-bit x86.
CC [M] fs/fat/namei_vfat.o
In file included from ./arch/x86/include/asm/string.h:2:0,
from ./include/linux/string.h:18,
from ./include/linux/bitmap.h:8,
from ./include/linux/cpumask.h:11,
from ./arch/x86/include/asm/cpumask.h:4,
from ./arch/x86/include/asm/msr.h:10,
from ./arch/x86/include/asm/processor.h:20,
from ./arch/x86/include/asm/cpufeature.h:4,
from ./arch/x86/include/asm/thread_info.h:52,
from ./include/linux/thread_info.h:37,
from ./arch/x86/include/asm/preempt.h:6,
from ./include/linux/preempt.h:80,
from ./include/linux/spinlock.h:50,
from ./include/linux/seqlock.h:35,
from ./include/linux/time.h:5,
from ./include/linux/stat.h:18,
from ./include/linux/module.h:10,
from fs/fat/namei_vfat.c:18:
fs/fat/namei_vfat.c: In function ‘vfat_add_entry’:
./arch/x86/include/asm/string_32.h:74:16: warning: array subscript is above array bounds [-Warray-bounds]
*((char *)to + 4) = *((char *)from + 4);
~~~~~~~~~~~~^~~~
./arch/x86/include/asm/string_32.h:74:16: warning: array subscript is above array bounds [-Warray-bounds]
./arch/x86/include/asm/string_32.h:78:17: warning: array subscript is above array bounds [-Warray-bounds]
*((short *)to + 2) = *((short *)from + 2);
~~~~~~~~~~~~~^~~~
./arch/x86/include/asm/string_32.h:78:17: warning: array subscript is above array bounds [-Warray-bounds]
./arch/x86/include/asm/string_32.h:82:15: warning: array subscript is above array bounds [-Warray-bounds]
*((int *)to + 1) = *((int *)from + 1);
~~~~~~~~~~~^~~~
./arch/x86/include/asm/string_32.h:82:15: warning: array subscript is above array bounds [-Warray-bounds]
--
Meelis Roos (mroos@linux.ee)
[toc] | [next] | [standalone]
| From | Meelis Roos <mroos@linux.ee> |
|---|---|
| Date | 2017-07-07 16:00 +0200 |
| Message-ID | <u0BXA-4Oh-9@gated-at.bofh.it> |
| In reply to | #1683082 |
> > I do not know if this is old or new, just noticed it scrolling by while > > compiling current 4.12+git on 32-bit x86. > > Which version of compiler? gcc version 6.4.0 20170704 (Debian 6.4.0-1) After "touch fs/fat/namei_vfat.c" it appears consitently for me. Debian unstable, up to date. > Well, latest change of namei_vfat.c is Sep, 2016. And I can't reproduce > it by "gcc version 6.3.0 20170516 (Debian 6.3.0-18)". > > > CC [M] fs/fat/namei_vfat.o > > In file included from ./arch/x86/include/asm/string.h:2:0, > > from ./include/linux/string.h:18, > > from ./include/linux/bitmap.h:8, > > from ./include/linux/cpumask.h:11, > > from ./arch/x86/include/asm/cpumask.h:4, > > from ./arch/x86/include/asm/msr.h:10, > > from ./arch/x86/include/asm/processor.h:20, > > from ./arch/x86/include/asm/cpufeature.h:4, > > from ./arch/x86/include/asm/thread_info.h:52, > > from ./include/linux/thread_info.h:37, > > from ./arch/x86/include/asm/preempt.h:6, > > from ./include/linux/preempt.h:80, > > from ./include/linux/spinlock.h:50, > > from ./include/linux/seqlock.h:35, > > from ./include/linux/time.h:5, > > from ./include/linux/stat.h:18, > > from ./include/linux/module.h:10, > > from fs/fat/namei_vfat.c:18: > > fs/fat/namei_vfat.c: In function ‘vfat_add_entry’: > > ./arch/x86/include/asm/string_32.h:74:16: warning: array subscript is above array bounds [-Warray-bounds] > > *((char *)to + 4) = *((char *)from + 4); > > ‾‾‾‾‾‾‾‾‾‾‾‾^‾‾‾ > > ./arch/x86/include/asm/string_32.h:74:16: warning: array subscript is above array bounds [-Warray-bounds] > > ./arch/x86/include/asm/string_32.h:78:17: warning: array subscript is above array bounds [-Warray-bounds] > > *((short *)to + 2) = *((short *)from + 2); > > ‾‾‾‾‾‾‾‾‾‾‾‾‾^‾‾‾ > > ./arch/x86/include/asm/string_32.h:78:17: warning: array subscript is above array bounds [-Warray-bounds] > > ./arch/x86/include/asm/string_32.h:82:15: warning: array subscript is above array bounds [-Warray-bounds] > > *((int *)to + 1) = *((int *)from + 1); > > ‾‾‾‾‾‾‾‾‾‾‾^‾‾‾ > > ./arch/x86/include/asm/string_32.h:82:15: warning: array subscript is above array bounds [-Warray-bounds] > > -- Meelis Roos (mroos@linux.ee)
[toc] | [prev] | [next] | [standalone]
| From | OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> |
|---|---|
| Date | 2017-07-08 08:00 +0200 |
| Message-ID | <u0QWB-6Fl-3@gated-at.bofh.it> |
| In reply to | #1683203 |
Meelis Roos <mroos@linux.ee> writes: >> > I do not know if this is old or new, just noticed it scrolling by while >> > compiling current 4.12+git on 32-bit x86. >> >> Which version of compiler? > > gcc version 6.4.0 20170704 (Debian 6.4.0-1) > > After "touch fs/fat/namei_vfat.c" it appears consitently for me. Debian > unstable, up to date. Tried with same gcc version, I can't still reproduce it. Possible difference is, I'm using x86_64 gcc with ARCH=i386 (-m32). $ md5sum fs/fat/namei_vfat.c arch/x86/include/asm/string* d8994e21f6ebc27f89b30a2532b0bc1d fs/fat/namei_vfat.c e174dd82e3956479e76f2b78ba397287 arch/x86/include/asm/string.h 662b134b5adb0919ea23e95752a18290 arch/x86/include/asm/string_32.h b91bcf192dcde29933275f0901e5dac5 arch/x86/include/asm/string_64.h Source is same with above? -- OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
[toc] | [prev] | [next] | [standalone]
| From | OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> |
|---|---|
| Date | 2017-07-08 09:50 +0200 |
| Message-ID | <u0SF3-7MG-5@gated-at.bofh.it> |
| In reply to | #1683544 |
Meelis Roos <mroos@linux.ee> writes:
>> Source is same with above?
>
> Yes, same checksums.
> CONFIG_X86_USE_3DNOW=y
> CONFIG_UBSAN=y
> CONFIG_UBSAN_SANITIZE_ALL=y
OK. Succeed to reproduce. gcc's ubsan (CONFIG_UBSAN_SANITIZE_ALL=y) with
CONFIG_X86_USE_3DNOW=y outputs warnings of that.
But warnings are strange. The target of source is,
vfat_create_shortname:
extlen = 0;
if (ext_start) {
for (p = ext, ip = ext_start; extlen < 3 && ip < end; ip++) {
chl = to_shortname_char(nls, charbuf, sizeof(charbuf),
ip, &ext_info);
if (chl == 0)
continue;
if ((extlen + chl) > 3) {
is_shortname = 0;
break;
}
for (chi = 0; chi < chl; chi++) {
*p++ = charbuf[chi];
extlen++;
}
if (extlen >= 3) {
if (ip + 1 != end)
is_shortname = 0;
break;
}
}
}
[...]
memcpy(name_res + 8, ext, extlen); <= here
name_res == name_res[11], but extlen never be bigger than 3 (if I'm not
missing something). And extlen is not constant, but gcc outputs the
warnings on __constant_memcpy3d().
#define memcpy(t, f, n) \
(__builtin_constant_p((n)) \
? __constant_memcpy3d((t), (f), (n)) \
: __memcpy3d((t), (f), (n)))
And changing
memcpy(name_res + 8, ext, extlen);
to
__builtin_memcpy(name_res + 8, ext, extlen);
doesn't output warnings.
So, I'm not sure though, it looks like the bug of ubsan(?). (BTW, for
now, you can set CONFIG_UBSAN_SANITIZE_ALL=n to disable ubsan.)
Thanks.
--
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
[toc] | [prev] | [next] | [standalone]
| From | OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> |
|---|---|
| Date | 2017-07-07 16:10 +0200 |
| Message-ID | <u0BXA-4Oh-11@gated-at.bofh.it> |
| In reply to | #1683082 |
Meelis Roos <mroos@linux.ee> writes: > I do not know if this is old or new, just noticed it scrolling by while > compiling current 4.12+git on 32-bit x86. Which version of compiler? Well, latest change of namei_vfat.c is Sep, 2016. And I can't reproduce it by "gcc version 6.3.0 20170516 (Debian 6.3.0-18)". > CC [M] fs/fat/namei_vfat.o > In file included from ./arch/x86/include/asm/string.h:2:0, > from ./include/linux/string.h:18, > from ./include/linux/bitmap.h:8, > from ./include/linux/cpumask.h:11, > from ./arch/x86/include/asm/cpumask.h:4, > from ./arch/x86/include/asm/msr.h:10, > from ./arch/x86/include/asm/processor.h:20, > from ./arch/x86/include/asm/cpufeature.h:4, > from ./arch/x86/include/asm/thread_info.h:52, > from ./include/linux/thread_info.h:37, > from ./arch/x86/include/asm/preempt.h:6, > from ./include/linux/preempt.h:80, > from ./include/linux/spinlock.h:50, > from ./include/linux/seqlock.h:35, > from ./include/linux/time.h:5, > from ./include/linux/stat.h:18, > from ./include/linux/module.h:10, > from fs/fat/namei_vfat.c:18: > fs/fat/namei_vfat.c: In function ‘vfat_add_entry’: > ./arch/x86/include/asm/string_32.h:74:16: warning: array subscript is above array bounds [-Warray-bounds] > *((char *)to + 4) = *((char *)from + 4); > ~~~~~~~~~~~~^~~~ > ./arch/x86/include/asm/string_32.h:74:16: warning: array subscript is above array bounds [-Warray-bounds] > ./arch/x86/include/asm/string_32.h:78:17: warning: array subscript is above array bounds [-Warray-bounds] > *((short *)to + 2) = *((short *)from + 2); > ~~~~~~~~~~~~~^~~~ > ./arch/x86/include/asm/string_32.h:78:17: warning: array subscript is above array bounds [-Warray-bounds] > ./arch/x86/include/asm/string_32.h:82:15: warning: array subscript is above array bounds [-Warray-bounds] > *((int *)to + 1) = *((int *)from + 1); > ~~~~~~~~~~~^~~~ > ./arch/x86/include/asm/string_32.h:82:15: warning: array subscript is above array bounds [-Warray-bounds] -- OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web