From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from relay.sgi.com (relay1.corp.sgi.com [137.38.102.111]) by oss.sgi.com (Postfix) with ESMTP id 2E31B7F37 for ; Wed, 7 Oct 2015 16:24:28 -0500 (CDT) Received: from cuda.sgi.com (cuda2.sgi.com [192.48.176.25]) by relay1.corp.sgi.com (Postfix) with ESMTP id 111268F8033 for ; Wed, 7 Oct 2015 14:24:27 -0700 (PDT) Received: from ipmail06.adl6.internode.on.net (ipmail06.adl6.internode.on.net [150.101.137.145]) by cuda.sgi.com with ESMTP id fkI60EtQMwrE3tbl for ; Wed, 07 Oct 2015 14:24:25 -0700 (PDT) Date: Thu, 8 Oct 2015 08:24:22 +1100 From: Dave Chinner Subject: Re: [PATCH] xfs: avoid null *src in memcpy call in xlog_write Message-ID: <20151007212422.GS27164@dastard> References: <56154967.70100@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <56154967.70100@redhat.com> List-Id: XFS Filesystem from SGI List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: xfs-bounces@oss.sgi.com Sender: xfs-bounces@oss.sgi.com To: Eric Sandeen Cc: xfs@oss.sgi.com On Wed, Oct 07, 2015 at 11:33:43AM -0500, Eric Sandeen wrote: > The gcc undefined behavior sanitizer caught this; surely > any sane memcpy implementation will no-op if size == 0, > but behavior with a *src of NULL is technically undefined > (declared nonnull), so avoid it here. > > We are actually in this situation frequently via > xlog_commit_record(), because: > > struct xfs_log_iovec reg = { > .i_addr = NULL, > .i_len = 0, > .i_type = XLOG_REG_TYPE_COMMIT, > }; > > Signed-off-by: Eric Sandeen > --- > > diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c > index 4012523..8897fd1 100644 > --- a/fs/xfs/xfs_log.c > +++ b/fs/xfs/xfs_log.c > @@ -2424,7 +2424,10 @@ xlog_write( > > /* copy region */ > ASSERT(copy_len >= 0); > - memcpy(ptr, reg->i_addr + copy_off, copy_len); > + ASSERT(reg->i_addr + copy_off > 0 || copy_len == 0); > + /* size == 0 is ok, but *src == NULL is undefined */ > + if (reg->i_addr + copy_off) > + memcpy(ptr, reg->i_addr + copy_off, copy_len); > xlog_write_adv_cnt(&ptr, &len, &log_offset, copy_len); The comment doesn't explain anything about why copylen might be zero or reg->i_addr might be null. If copylen is zero, we should really skip the copy, not rely on some magic pointer arithmetic to tell us it's ok to copy... /* * Copy region. * * Unmount records just log an opheader, so can have * empty payloads with no data region to copy. Hence we only * copy the payload if the vector says it has data to copy. */ ASSERT(copy_len >= 0); if (copy_len > 0) { memcpy(ptr, reg->i_addr + copy_off, copy_len); xlog_write_adv_cnt(&ptr, &len, &log_offset, copy_len); } Cheers, Dave. -- Dave Chinner david@fromorbit.com _______________________________________________ xfs mailing list xfs@oss.sgi.com http://oss.sgi.com/mailman/listinfo/xfs