Project

General

Profile

Actions

Bug #14343

closed

ufs: array subscript 'struct direct[0]' is partly outside array bounds

Added by Toomas Soome 7 months ago. Updated 6 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
filesystems (not ZFS)
Start date:
Due date:
% Done:

100%

Estimated time:
Difficulty:
Bite-size
Tags:
Gerrit CR:

Description

Build error with gcc 11:

    ../../common/fs/ufs/ufs_dir.c: In function 'ufs_dirscan':
    ../../common/fs/ufs/ufs_dir.c:2905:44: error: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Werror=array-bounds]
     2905 |                 if (err || count != 0 || dp->d_reclen == 0) {
          |                                            ^~
    ../../common/fs/ufs/ufs_dir.c:2889:28: note: while referencing 'dbuf'
     2889 |         struct dirtemplate dbuf;
          |                            ^~~~
    ../../common/fs/ufs/ufs_dir.c:2910:23: error: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Werror=array-bounds]
     2910 |                 if (dp->d_ino == 0)
          |                       ^~
    ../../common/fs/ufs/ufs_dir.c:2889:28: note: while referencing 'dbuf'
     2889 |         struct dirtemplate dbuf;
          |                            ^~~~
    ../../common/fs/ufs/ufs_dir.c:2913:23: error: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Werror=array-bounds]
     2913 |                 if (dp->d_namlen > 2 || dp->d_name[0] != '.') {
          |                       ^~
    ../../common/fs/ufs/ufs_dir.c:2889:28: note: while referencing 'dbuf'
     2889 |         struct dirtemplate dbuf;
          |                            ^~~~
    ../../common/fs/ufs/ufs_dir.c:2913:43: error: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Werror=array-bounds]
     2913 |                 if (dp->d_namlen > 2 || dp->d_name[0] != '.') {
          |                                           ^~
    ../../common/fs/ufs/ufs_dir.c:2889:28: note: while referencing 'dbuf'
     2889 |         struct dirtemplate dbuf;
          |                            ^~~~
    ../../common/fs/ufs/ufs_dir.c:2924:23: error: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Werror=array-bounds]
     2924 |                 if (dp->d_name[1] == '.' &&
          |                       ^~
    ../../common/fs/ufs/ufs_dir.c:2889:28: note: while referencing 'dbuf'
     2889 |         struct dirtemplate dbuf;
          |                            ^~~~
    ../../common/fs/ufs/ufs_dir.c: In function 'ufs_xattrdirempty':
    ../../common/fs/ufs/ufs_dir.c:3128:44: error: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Werror=array-bounds]
     3128 |                 if (err || count != 0 || dp->d_reclen == 0) {
          |                                            ^~
    ../../common/fs/ufs/ufs_dir.c:3111:28: note: while referencing 'dbuf'
     3111 |         struct dirtemplate dbuf;
          |                            ^~~~
    ../../common/fs/ufs/ufs_dir.c:3133:23: error: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Werror=array-bounds]
     3133 |                 if (dp->d_ino == 0)
          |                       ^~
    ../../common/fs/ufs/ufs_dir.c:3111:28: note: while referencing 'dbuf'
     3111 |         struct dirtemplate dbuf;
          |                            ^~~~
    ../../common/fs/ufs/ufs_dir.c:3141:23: error: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Werror=array-bounds]
     3141 |                 if (dp->d_namlen == 1 && dp->d_name[0] == '.' &&
          |                       ^~
    ../../common/fs/ufs/ufs_dir.c:3111:28: note: while referencing 'dbuf'
     3111 |         struct dirtemplate dbuf;
          |                            ^~~~
    ../../common/fs/ufs/ufs_dir.c:3141:44: error: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Werror=array-bounds]
     3141 |                 if (dp->d_namlen == 1 && dp->d_name[0] == '.' &&
          |                                            ^~
    ../../common/fs/ufs/ufs_dir.c:3111:28: note: while referencing 'dbuf'
     3111 |         struct dirtemplate dbuf;
          |                            ^~~~
    ../../common/fs/ufs/ufs_dir.c:3145:63: error: array subscript 'struct direct[0]' is partly outside array bounds of 'struct dirtemplate[1]' [-Werror=array-bounds]
     3145 |                 if (dp->d_namlen == 2 && dp->d_name[0] == '.' &&
          |                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~
     3146 |                     dp->d_name[1] == '.') {
          |                     ~~~~~~~~~~~~~~~~~~~~
    ../../common/fs/ufs/ufs_dir.c:3111:28: note: while referencing 'dbuf'
     3111 |         struct dirtemplate dbuf;
          |                            ^~~~
    cc1: all warnings being treated as errors

This is new class of errors, exposed by gcc 11. We read only partial data structure and then are accessing some fields from this structure. Of course the compiler does not know we are trying to use ugly hack and is complaining loud. Fix would be to either fill whole structure or define struct with subset of fields we are actually needing. In this case, I guess, it is ok to define smaller struct.

Testing done: build/install/boot. Create ufs, build some directory tree and delete it, verify with dtrace the ufs_dirscan() was used...

Actions #1

Updated by Electric Monk 7 months ago

  • Gerrit CR set to 1898
Actions #2

Updated by Toomas Soome 7 months ago

  • Description updated (diff)
Actions #3

Updated by Electric Monk 7 months ago

  • Status changed from In Progress to Closed
  • % Done changed from 90 to 100

git commit 7939798324de96253652dd33a2a42e25e4ab61f9

commit  7939798324de96253652dd33a2a42e25e4ab61f9
Author: Toomas Soome <tsoome@me.com>
Date:   2022-01-26T21:22:02.000Z

    14343 ufs: array subscript 'struct direct[0]' is partly outside array bounds
    Reviewed by: Robert Mustacchi <rm@fingolfin.org>
    Approved by: Dan McDonald <danmcd@joyent.com>

Actions #4

Updated by Joshua M. Clulow 6 months ago

Did you fsck the UFS filesystem after doing the testing?

Actions #5

Updated by Toomas Soome 6 months ago

Joshua M. Clulow wrote in #note-4:

Did you fsck the UFS filesystem after doing the testing?

root@test:/home/tsoome# newfs /dev/rdsk/c3t3d0s0
newfs: construct a new file system /dev/rdsk/c3t3d0s0: (y/n)? y
Warning: 2338 sector(s) in last cylinder unallocated
/dev/rdsk/c3t3d0s0:     20954846 sectors in 3411 cylinders of 48 tracks, 128 sectors
        10231,9MB in 214 cyl groups (16 c/g, 48,00MB/g, 5824 i/g)
super-block backups (for fsck -F ufs -o b=#) at:
 32, 98464, 196896, 295328, 393760, 492192, 590624, 689056, 787488, 885920,
 20055584, 20154016, 20252448, 20350880, 20449312, 20547744, 20646176,
 20744608, 20843040, 20941472
root@test:/home/tsoome# fsck  /dev/rdsk/c3t3d0s0
** /dev/rdsk/c3t3d0s0
** Last Mounted on 
** Phase 1 - Check Blocks and Sizes
** Phase 2 - Check Pathnames
** Phase 3a - Check Connectivity
** Phase 3b - Verify Shadows/ACLs
** Phase 4 - Check Reference Counts
** Phase 5 - Check Cylinder Groups
2 files, 9 used, 10318178 free (18 frags, 1289770 blocks, 0.0% fragmentation)
root@test:/home/tsoome# mount /dev/dsk/c3t3d0s0
mount: Invalid argument
root@test:/home/tsoome# mount /dev/dsk/c3t3d0s0 /mnt
root@test:/home/tsoome# cd /
root@test:/# tar cf - usr | (cd /mnt; tar xf -)
umount /mnt
fsck  /dev/rdsk/c3t3d0s0
root@test:/# umount /mnt
root@test:/# fsck  /dev/rdsk/c3t3d0s0
** /dev/rdsk/c3t3d0s0
** Last Mounted on /mnt
** Phase 1 - Check Blocks and Sizes
** Phase 2 - Check Pathnames
** Phase 3a - Check Connectivity
** Phase 3b - Verify Shadows/ACLs
** Phase 4 - Check Reference Counts
** Phase 5 - Check Cylinder Groups
200640 files, 6749314 used, 3558633 free (12289 frags, 443293 blocks, 0.1% fragmentation)
root@test:/# 

<pre>

I do not see it should be affected - the previous structure was accessing the same amount of data, just that that structure was providing less memory space and that was the basis for gcc to complain.
Actions #6

Updated by Joshua M. Clulow 6 months ago

Indeed! With my apologies, I had thought something was amiss here but it turned out to be #14537 instead.

Actions

Also available in: Atom PDF