Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1752692AbdGHHm2 (ORCPT <rfc822;w@1wt.eu>);
        Sat, 8 Jul 2017 03:42:28 -0400
Received: from mail.parknet.co.jp ([210.171.160.6]:49771 "EHLO
        mail.parknet.co.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751078AbdGHHm1 (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Sat, 8 Jul 2017 03:42:27 -0400
From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
To: Meelis Roos <mroos@linux.ee>
Cc: Linux Kernel list <linux-kernel@vger.kernel.org>
Subject: Re: namei_vfat.c array subscript is above array bounds
References: <alpine.LRH.2.20.1707071233260.605@math.ut.ee>
        <8760f4pdhz.fsf@devron> <alpine.LRH.2.20.1707071647480.605@math.ut.ee>
        <871sprpj32.fsf@devron>
        <alpine.LRH.2.20.1707080911320.9910@math.ut.ee>
Date: Sat, 08 Jul 2017 16:42:25 +0900
In-Reply-To: <alpine.LRH.2.20.1707080911320.9910@math.ut.ee> (Meelis Roos's
        message of "Sat, 8 Jul 2017 09:13:59 +0300 (EEST)")
Message-ID: <87wp7jnzmm.fsf@devron>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.0.50 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 1504
Lines: 70

Meelis Roos <mroos@linux.ee> writes:

>> Source is same with above?
>
> Yes, same checksums.

> CONFIG_X86_USE_3DNOW=y
> CONFIG_UBSAN=y
> CONFIG_UBSAN_SANITIZE_ALL=y

OK. Succeed to reproduce. gcc's ubsan (CONFIG_UBSAN_SANITIZE_ALL=y) with
CONFIG_X86_USE_3DNOW=y outputs warnings of that.

But warnings are strange. The target of source is,

vfat_create_shortname:

	extlen = 0;
	if (ext_start) {
		for (p = ext, ip = ext_start; extlen < 3 && ip < end; ip++) {
			chl = to_shortname_char(nls, charbuf, sizeof(charbuf),
						ip, &ext_info);
			if (chl == 0)
				continue;

			if ((extlen + chl) > 3) {
				is_shortname = 0;
				break;
			}
			for (chi = 0; chi < chl; chi++) {
				*p++ = charbuf[chi];
				extlen++;
			}
			if (extlen >= 3) {
				if (ip + 1 != end)
					is_shortname = 0;
				break;
			}
		}
	}

[...]

	memcpy(name_res + 8, ext, extlen);    <= here

name_res == name_res[11], but extlen never be bigger than 3 (if I'm not
missing something). And extlen is not constant, but gcc outputs the
warnings on __constant_memcpy3d().

#define memcpy(t, f, n)				\
	(__builtin_constant_p((n))		\
	 ? __constant_memcpy3d((t), (f), (n))	\
	 : __memcpy3d((t), (f), (n)))

And changing

	memcpy(name_res + 8, ext, extlen);

to

        __builtin_memcpy(name_res + 8, ext, extlen);

doesn't output warnings.

So, I'm not sure though, it looks like the bug of ubsan(?). (BTW, for
now, you can set CONFIG_UBSAN_SANITIZE_ALL=n to disable ubsan.)

Thanks.
-- 
OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>