Several functions perform out-of-bounds memory accesses (which is UB)

I found this code which openly admits to doing OOB accesses:

https://github.com/rust-lang/compiler-builtins/blob/2a67ad74b77dd5c7dbd77a27156176136b0b606d/src/mem/impls.rs#L64-L70

This code also looks suspicious, e.g. if this is used to implement 2-byte atomic accesses then there is OOB here:

https://github.com/rust-lang/compiler-builtins/blob/56172fcd8bd045e38bbdf76697d1fcca1e965d6d/src/arm_linux.rs#L57-L89

I haven't done a thorough audit so there might be more. I found these by grepping for `atomic_load_unordered`.

	// This will read (but won't use) bytes out of bound.
	// cfg needed because not all targets will have atomic loads that can be lowered
	// (e.g. BPF, MSP430), or provided by an external library (e.g. RV32I)
	#[cfg(target_has_atomic_load_store = "ptr")]
	let mut prev_word = core::intrinsics::atomic_load_unordered(src_aligned);
	#[cfg(not(target_has_atomic_load_store = "ptr"))]
	let mut prev_word = core::ptr::read_volatile(src_aligned);

	// Generic atomic read-modify-write operation
	unsafe fn atomic_rmw<T, F: Fn(u32) -> u32, G: Fn(u32, u32) -> u32>(ptr: *mut T, f: F, g: G) -> u32 {
	let aligned_ptr = align_ptr(ptr);
	let (shift, mask) = get_shift_mask(ptr);

	loop {
	let curval_aligned = intrinsics::atomic_load_unordered(aligned_ptr);
	let curval = extract_aligned(curval_aligned, shift, mask);
	let newval = f(curval);
	let newval_aligned = insert_aligned(curval_aligned, newval, shift, mask);
	if __kuser_cmpxchg(curval_aligned, newval_aligned, aligned_ptr) {
	return g(curval, newval);
	}
	}
	}

	// Generic atomic compare-exchange operation
	unsafe fn atomic_cmpxchg<T>(ptr: *mut T, oldval: u32, newval: u32) -> u32 {
	let aligned_ptr = align_ptr(ptr);
	let (shift, mask) = get_shift_mask(ptr);

	loop {
	let curval_aligned = intrinsics::atomic_load_unordered(aligned_ptr);
	let curval = extract_aligned(curval_aligned, shift, mask);
	if curval != oldval {
	return curval;
	}
	let newval_aligned = insert_aligned(curval_aligned, newval, shift, mask);
	if __kuser_cmpxchg(curval_aligned, newval_aligned, aligned_ptr) {
	return oldval;
	}
	}
	}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Several functions perform out-of-bounds memory accesses (which is UB) #559

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development