Re: [PATCH v4] riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts

From: "Troy Mitchell" <troy.mitchell@linux.dev>
To: <shao.mingyin@zte.com.cn>, <pjw@kernel.org>, <mikey@neuling.org>
Cc: <jiangfeng@kylinos.cn>, <palmer@dabbelt.com>,
	<aou@eecs.berkeley.edu>, <alex@ghiti.fr>,
	<linux-riscv@lists.infradead.org>, <linux-kernel@vger.kernel.org>,
	<zhang.yue5@zte.com.cn>, <david.laight.linux@gmail.com>,
	<qingfang.deng@linux.dev>,
	"linux-riscv" <linux-riscv-bounces@lists.infradead.org>,
	"Troy Mitchell" <troy.mitchell@linux.dev>
Subject: Re: [PATCH v4] riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
Date: Tue, 22 Sep 2026 11:48:23 +0800	[thread overview]
Message-ID: <DLLJDLKPZ4S3.1KQ5O4OQBBTEW@linux.dev> (raw)
In-Reply-To: <20260915152656708z04s4oSYY2BGj34F36RZa@zte.com.cn>


[-- Attachment #1.1: Type: text/plain, Size: 1763 bytes --]

On Tue Sep 15, 2026 at 3:26 PM +08, shao.mingyin wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
>
> The aligned scan boundary is derived from the last valid byte,
> (s + count - 1).  When count is huge (e.g. SIZE_MAX, which FORTIFY
> strcat/strlcat pass when the destination size is not known at compile
> time), s + count wraps around and the boundary lands before s, so the
> ZBB path returns a bogus length.  The original implementation
> (5ba15d419fab) had the same wrap-around in its (s + count) & ~7
> boundary computation; after 5d588c684833 the wrapped boundary is caught
> by the pre-loop guard "bgeu t0, t4, 2f", which then always exits for
> aligned strings of 8 or more characters and strnlen() returns 8
> instead of the real length.
>
> This silently truncates strings built by fortified strcat: the dm
> sysfs name attribute shows "live-bas" instead of "live-base", the
> truncated name pollutes the udev database, and blivet/anaconda (as
> well as LVM/dm-crypt/multipath userspace) break on RISC-V systems.
>
> Detect the wrap-around and saturate the boundary to the top of the
> address space, making the scan equivalent to strlen().  The saturation
> clamps the increment to ~s, so it stays branchless and wrap-free:
>
> 	s + min(count - 1, ~s) == saturating_add(s, count - 1)
>
> Normal counts are unaffected.
>
> Fixes: 5ba15d419fab ("riscv: lib: add strnlen() implementation")
> Cc: stable@vger.kernel.org
> Suggested-by: David Laight <david.laight.linux@gmail.com>
> Suggested-by: Qingfang Deng <qingfang.deng@linux.dev>
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
> Acked-by: Michael Neuling <mikey@neuling.org>
Tested-by: Troy Mitchell <troy.mitchell@linux.dev>

-- 
Troy Mitchell


[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 273 bytes --]

[-- Attachment #2: Type: text/plain, Size: 161 bytes --]

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv