linux-kernel - Re: [alobakin:pfcp 11/19] include/linux/bitmap.h:642:17: warning: array subscript [1, 1024] is outside array bounds of 'long unsigned int[1]'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG_fn=VtA6e3oGm4WVnxmy9yMBab780-U_4VoHSqm4tcd2UTzQ@mail.gmail.com>
Date:   Tue, 7 Nov 2023 17:33:56 +0100
From:   Alexander Potapenko <glider@...gle.com>
To:     Alexander Lobakin <aleksander.lobakin@...el.com>
Cc:     Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Yury Norov <yury.norov@...il.com>,
        Syed Nayyar Waris <syednwaris@...il.com>,
        kernel test robot <lkp@...el.com>,
        oe-kbuild-all@...ts.linux.dev,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [alobakin:pfcp 11/19] include/linux/bitmap.h:642:17: warning:
 array subscript [1, 1024] is outside array bounds of 'long unsigned int[1]'

On Tue, Nov 7, 2023 at 2:23 PM Alexander Lobakin
<aleksander.lobakin@...el.com> wrote:
>
> From: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
> Date: Mon, 6 Nov 2023 20:23:52 +0200
>
> > On Mon, Nov 06, 2023 at 05:31:34PM +0100, Alexander Lobakin wrote:
> >
> >>> | Reported-by: kernel test robot <lkp@...el.com>
> >>> | Closes: https://lore.kernel.org/oe-kbuild-all/202310170708.fJzLlgDM-lkp@intel.com/
> >
> >> Not sure how to approach this :z It was also captured on the version you
> >> sent 2 weeks ago, so this could've been resolved already.
> >
> > Is it in the repository already? if so, we should revert it.
> > Otherwise you have time to think and fix.
>
> Nah, neither Alex' series nor mine. And I'd say this should rather be
> resolved in the functions Alex introduce.
>
> Thanks,
> Olek

Sorry, I couldn't reproduce the problem using the instructions at
https://download.01.org/0day-ci/archive/20231017/202310170708.fJzLlgDM-lkp@intel.com/reproduce
locally, maybe that's because I only have gcc-11 and higher.

But if I'm understanding correctly what's going on, then GCC will be
reporting the same issue in the following code:

=======================================================
#include <stddef.h>
#include <stdbool.h>

#define BITS_PER_LONG 64
#define unlikely(x) x
#define UL(x) (x##UL)
#define GENMASK(h, l) \
        (((~UL(0)) - (UL(1) << (l)) + 1) & \
         (~UL(0) >> (BITS_PER_LONG - 1 - (h))))

#define BIT_WORD(nr)            ((nr) / BITS_PER_LONG)
#define BITMAP_FIRST_WORD_MASK(start) (~0UL << ((start) & (BITS_PER_LONG - 1)))
#define BITMAP_LAST_WORD_MASK(nbits) (~0UL >> (-(nbits) & (BITS_PER_LONG - 1)))

inline void bitmap_write(unsigned long *map,
                                unsigned long value,
                                unsigned long start, unsigned long nbits)
{
        size_t index;
        unsigned long offset;
        unsigned long space;
        unsigned long mask;
        bool fit;

        if (unlikely(!nbits))
                return;

        mask = BITMAP_LAST_WORD_MASK(nbits);
        value &= mask;
        offset = start % BITS_PER_LONG;
        space = BITS_PER_LONG - offset;
        fit = space >= nbits;
        index = BIT_WORD(start);

        map[index] &= (fit ? (~(mask << offset)) :
~BITMAP_FIRST_WORD_MASK(start));
        map[index] |= value << offset;
        if (fit)
                return;

        map[index + 1] &= BITMAP_FIRST_WORD_MASK(start + nbits);
        map[index + 1] |= (value >> space);
}

unsigned long foo(unsigned int n) {
    unsigned long bm[1] = {0};
    bitmap_write(bm, 1, n, 2);
    return bm[0];
}
=======================================================
(see also https://godbolt.org/z/GfGfYje53)

If so, the problem is not specific to GCC 9, trunk GCC also barks on this code:

=======================================================
In function 'bitmap_write',
    inlined from 'bitmap_write' at <source>:15:13,
    inlined from 'foo' at <source>:47:7:
<source>:40:12: warning: array subscript 1 is outside array bounds of
'long unsigned int[1]' [-Warray-bounds=]
   40 |         map[index + 1] &= BITMAP_FIRST_WORD_MASK(start + nbits);
      |         ~~~^~~~~~~~~~~
=======================================================

If this is true for the code in drivers/gpio/gpio-pca953x.c,
suppressing the report for GCC 9 won't help for other versions.
Given that this report is isolated in a single file, we probably need
to give the compiler some hints about the range of values passed to
bitmap_write() rather than suppressing the optimizations.

-- 
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Straße, 33
80636 München

Geschäftsführer: Paul Manicle, Liana Sebastian
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg