From: Alexander Cherepanov <ch3root@openwall.com>
To: musl@lists.openwall.com
Subject: Re: string word-at-a-time and atomic.h FAQ on twitter
Date: Tue, 12 Jan 2016 15:41:57 +0300 [thread overview]
Message-ID: <5694F495.3010203@openwall.com> (raw)
In-Reply-To: <20160108225951.GP238@brightrain.aerifal.cx>
On 2016-01-09 01:59, Rich Felker wrote:
> On Sat, Jan 09, 2016 at 01:39:10AM +0300, Alexander Cherepanov wrote:
>>>>>> this takes care of oob access, but the bytes outside the passed
>>>>>> object might change concurrently i.e. strlen might introduce a
>>>>>> data race: again this is a problem on the abstract c language
>>>>>> level that may be solved e.g. by making all accesses to those
>>>>>> bytes relaxed atomic, but user code is not under libc control.
>>>>>> in practice the code works if HASZERO reads the word once so it
>>>>>> does arithmetics with a consistent value (because the memory
>>>>>> model of the underlying machine does not treat such race
>>>>>> undefined and it does not propagate unspecified value bits nor
>>>>>> has trap representations).
>>>>>
>>>>> Indeed, this seems like less of a practical concern.
>>>>
>>>> HASZERO reads the word twice so this should be a problem for
>>>> unoptimized code on big-endian platforms.
>>>
>>> The number of abstract-machine reads is irrelevant unless we use
>>> volatile here. A good compiler will always reduce it to one read, and
>>> a bad compiler is always free to turn it into multiple reads.
>>
>> Ok, I'll reformulate: is compiling musl on a big-endian platform
>> with optimizations turned off officially supported?
>
> Yes, and I don't see why you expect this case to break due to data
> race issues.
Right, I was too fast. I checked that outside bytes affect computations
on inside bytes (on BE platforms) but the effect is not strong enough to
break the code. Sorry for the noise.
Perhaps a comment is warranted in this and other hairy cases (like qsort)?
As for a list of affected functions, the first approximation:
$ grep -rF HASZERO | grep -v '#define'
src/string/stpcpy.c: for (; !HASZERO(*ws); *wd++ = *ws++);
src/string/memchr.c: for (w = (const void *)s; n>=SS && !HASZERO(*w^k);
w++, n-=SS);
src/string/strlen.c: for (w = (const void *)s; !HASZERO(*w); w++);
src/string/strchrnul.c: for (w = (void *)s; !HASZERO(*w) &&
!HASZERO(*w^k); w++);
src/string/memccpy.c: for (; n>=sizeof(size_t) && !HASZERO(*ws^k);
src/string/strlcpy.c: for (; n>=sizeof(size_t) && !HASZERO(*ws);
src/string/stpncpy.c: for (; n>=sizeof(size_t) && !HASZERO(*ws);
HASZERO is not guarded by a size check in strpcpy, strlen and strchrnul.
--
Alexander Cherepanov
next prev parent reply other threads:[~2016-01-12 12:41 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-05 16:46 Szabolcs Nagy
2016-01-05 17:50 ` Rich Felker
2016-01-05 23:39 ` Matthew Fernandez
2016-01-06 2:56 ` Szabolcs Nagy
2016-01-08 21:59 ` Alexander Cherepanov
2016-01-08 22:05 ` Rich Felker
2016-01-08 22:39 ` Alexander Cherepanov
2016-01-08 22:59 ` Rich Felker
2016-01-09 1:40 ` Szabolcs Nagy
2016-01-12 12:41 ` Alexander Cherepanov [this message]
2016-01-12 21:02 ` Alexander Cherepanov
2016-01-12 21:09 ` Alexander Cherepanov
2016-01-12 23:07 ` Szabolcs Nagy
2016-01-13 17:30 ` Szabolcs Nagy
2016-01-14 12:49 ` Szabolcs Nagy
2016-01-14 22:51 ` Rich Felker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5694F495.3010203@openwall.com \
--to=ch3root@openwall.com \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).