lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-29 11:41:21 +03:00
Code Activity

posix: Fix -Warray-bounds instances building timer_create [BZ #26687]

Browse Source 
GCC 11 -Warray-bounds triggers invalid warnings when building
Linux timer_create.c:

../sysdeps/unix/sysv/linux/timer_create.c: In function '__timer_create_new':
../sysdeps/unix/sysv/linux/timer_create.c:83:17: warning: array subscript 'struct timer[0]' is partly outside array bounds of 'unsigned char[8]' [-Warray-bounds]
   83 |             newp->sigev_notify = (evp != NULL
      |                 ^~
../sysdeps/unix/sysv/linux/timer_create.c:59:47: note: referencing an object of size 8 allocated by 'malloc'
   59 |         struct timer *newp = (struct timer *) malloc (offsetof (struct timer,
      |                                               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   60 |                                                                 thrfunc));
      |                                                                 ~~~~~~~~~

The struct allocated for !SIGEV_THREAD timers only requires two 'int'
fields (sigev_notify and ktimerid) and the offsetof trick tries minimize
the memory usage by only allocation the required size.  However,
although the resulting size is suffice for !SIGEV_THREAD time, accessing
the partially allocated object is error-prone and UB.

This patch fixes both issues by embedding the information whether
the timer if a SIGEV_THREAD in the returned 'timer_t'.  For
!SIGEV_THREAD, the resulting 'timer_t' is the returned kernel timer
identifer (kernel_timer_t), while for SIGEV_THREAD it uses the fact
malloc returns at least _Alignof (max_align_t) pointers plus that
valid kernel_timer_t are always positive to set MSB bit of the returned
'timer_t' to indicate the timer handles a SIGEV_THREAD.

It allows to remove the memory allocation for !SIGEV_THREAD and also
remove the 'sigev_notify' field from 'struct timer'.

Checked on x86_64-linux-gnu and i686-linux-gnu.
This commit is contained in:
Adhemerval Zanella
2020-10-05 17:30:05 -03:00
parent 862897d2ad
commit 7a887dd537
8 changed files with 83 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
sysdeps/unix/sysv/linux/timer_delete.c
View File

@ -32,15 +32,15 @@ int
timer_delete (timer_t timerid)
{
#undef timer_delete
struct timer *kt = (struct timer *) timerid;
/* Delete the kernel timer object. */
int res = INLINE_SYSCALL (timer_delete, 1, kt->ktimerid);
kernel_timer_t ktimerid = timerid_to_kernel_timer (timerid);
int res = INLINE_SYSCALL_CALL (timer_delete, ktimerid);
if (res == 0)
{
if (kt->sigev_notify == SIGEV_THREAD)
if (timer_is_sigev_thread (timerid))
{
struct timer *kt = timerid_to_timer (timerid);
/* Remove the timer from the list. */
pthread_mutex_lock (&__active_timer_sigev_thread_lock);
if (__active_timer_sigev_thread == kt)
@ -58,10 +58,9 @@ timer_delete (timer_t timerid)
prevp = prevp->next;
}
pthread_mutex_unlock (&__active_timer_sigev_thread_lock);
}
/* Free the memory. */
(void) free (kt);
free (kt);
}
return 0;
}