From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
To: Kent Overstreet <kent.overstreet@linux.dev>,
Brian Foster <bfoster@redhat.com>
Cc: Kees Cook <keescook@chromium.org>,
linux-kernel <linux-kernel@vger.kernel.org>,
linux-bcachefs@vger.kernel.org
Subject: Use of zero-length arrays in bcachefs structures inner fields
Date: Thu, 23 May 2024 13:53:42 -0400 [thread overview]
Message-ID: <986294ee-8bb1-4bf4-9f23-2bc25dbad561@efficios.com> (raw)
Hi Kent,
Looking around in the bcachefs code for possible causes of this KMSAN
bug report:
https://lore.kernel.org/lkml/000000000000fd5e7006191f78dc@google.com/
I notice the following pattern in the bcachefs structures: zero-length
arrays members are inserted in structures (not always at the end),
seemingly to achieve a result similar to what could be done with a
union:
fs/bcachefs/bcachefs_format.h:
struct bkey_packed {
__u64 _data[0];
/* Size of combined key and value, in u64s */
__u8 u64s;
[...]
};
likewise:
struct bkey_i {
__u64 _data[0];
struct bkey k;
struct bch_val v;
};
(and there are many more examples of this pattern in bcachefs)
AFAIK, the C11 standard states that array declarator constant expression
delimited by [ ] shall have a value greater than zero.
Effectively, we can verify that this code triggers an undefined behavior
with:
#include <stdio.h>
struct z {
int x[0];
int y;
int z;
} __attribute__((packed));
int main(void)
{
struct z a;
a.y = 1;
printf("%d\n", a.x[0]);
}
clang-15 -fsanitize=undefined -o a a.c
./a
a.c:14:17: runtime error: index 0 out of bounds for type 'int[0]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior a.c:14:17 in
1
Also, gcc warns that ISO C forbids zero-size arrays when compiling
with -pedantic:
gcc -std=c11 -pedantic -o a a.c
a.c:4:13: warning: ISO C forbids zero-size array ‘x’ [-Wpedantic]
4 | int x[0];
And clang states that this is only supported as an extension, even though
accessing it seems to be classified as an undefined behavior by UBSAN.
clang-15 -std=c11 -pedantic -o a a.c
a.c:4:8: warning: zero size arrays are an extension [-Wzero-length-array]
int x[0];
So I wonder if the issue reported by KMSAN could be caused by this
pattern ?
Thanks,
Mathieu
--
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com
next reply other threads:[~2024-05-23 17:53 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-23 17:53 Mathieu Desnoyers [this message]
2024-05-24 15:28 ` Use of zero-length arrays in bcachefs structures inner fields Kent Overstreet
2024-05-24 15:35 ` Mathieu Desnoyers
2024-05-24 16:04 ` Mathieu Desnoyers
2024-05-24 17:30 ` Kent Overstreet
2024-05-28 11:36 ` Alexander Potapenko
2024-05-28 15:02 ` Kent Overstreet
2024-06-03 9:12 ` Alexander Potapenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=986294ee-8bb1-4bf4-9f23-2bc25dbad561@efficios.com \
--to=mathieu.desnoyers@efficios.com \
--cc=bfoster@redhat.com \
--cc=keescook@chromium.org \
--cc=kent.overstreet@linux.dev \
--cc=linux-bcachefs@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox