From nobody Fri Mar 04 19:48:16 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id C9B0A19F13A8; Fri, 4 Mar 2022 19:48:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4K9JLT1nBlz4sxX; Fri, 4 Mar 2022 19:48:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1646423297; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7yY48Uw1uA1hZztOsGGfQsaCKm9PLtoCiqPlmtgiP68=; b=EFLnfa/ReDxva9zpjQD19tdHRoof976F3FVd8JbkC9MFGpzMLsG9F5ankjukbSCNIbkPrE xEtpOXhqAva+0s73VqM+I0vzrLd4UsnQQ6h72oqZ/lXkiPB5ADlESMNOtYurN+4V/lfXZw aCa28jlMujSuBaEt5iOe3qmJ+elwyqVQbCOnvNOIydaYXGW9YuO2xz0pXFE2wZ5ClKhgAK Hr31ZhDWPiKdF1l4gezwkidBnjeX1t/eA9jM4zyPo7L04YUluiN8wfA4XbHrOENgrF6+oC e2OeQSOV9vaHa/RPfTcjO7lFZDHZxeUb+fECeLs2Our5T+dg2L91e6BbT6ReHA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 0378112916; Fri, 4 Mar 2022 19:48:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 224JmGdU069227; Fri, 4 Mar 2022 19:48:16 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 224JmGof069226; Fri, 4 Mar 2022 19:48:16 GMT (envelope-from git) Date: Fri, 4 Mar 2022 19:48:16 GMT Message-Id: <202203041948.224JmGof069226@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: =?utf-8?Q?Stefan E=C3=9Fer?= Subject: git: 19b00621b65f - stable/13 - qsort.c: prevent undefined behavior List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: se X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 19b00621b65fc4092417d33e12b471413f07228c Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1646423297; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7yY48Uw1uA1hZztOsGGfQsaCKm9PLtoCiqPlmtgiP68=; b=LMJbqj+h/j7eGMW0c+ODXIBX2ffX5lYv7/3vO6+ylh8fz/ALj8mWwo+hFfTXEH7z7U+qNK V32M4Za7rTw4eq7XO34farF4aR3qpzHeLzTOFvouKQ4wUJZBvaR4SZcQ0oK5Dwprbtsiad kvFrjBszNag2+Ezp0t3LJrN6SMsxLtABxf+lvhWuCwApnVNjWL/HaayKUdkgSE6mdkLqIb 5iHuf1D0lB18QLWvYcAZCiQCWDQG1KzjxdlgTl4JwdlAe7hVXdsw/QYoRP/xtbP/JtStYA uT+rmuZdwj2J13TXJkC2B8i01VHY+bHWLsNKaBlXbfpL1Zq/7kR5tETEIyTrJg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1646423297; a=rsa-sha256; cv=none; b=voQMTw+oKk9MVZsxUacLUqR9J5p7Fi9GaZ5GcxZdVWEmKih6uWsEFtsuMMuWIQYJciGXTq YaAOGzcuD9gdTerPzwSqFqY6W1q33BrcfHY+Qag5nARnuWVXx0kJVePXtQd1EP9QwQnceM vtXFVa7M4YWV/IrnUMZ18O0Ov01N5FyXbphx5BNgEX8PyeKIReSJabMFY7jhWGHoDLPenG q8yVsTgOCNtPMxH3VUo1Sg1NQnP6jZD+mFeLI8SLVESK54B79l7MbWR2P+7yvS2v99h3h0 eGwveO9smocXyDbEpIPAx+D99K/mO0VYYTzN9yRSbgGxZVkBAgKNJBMo71OAGw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by se: URL: https://cgit.FreeBSD.org/src/commit/?id=19b00621b65fc4092417d33e12b471413f07228c commit 19b00621b65fc4092417d33e12b471413f07228c Author: Stefan Eßer AuthorDate: 2022-01-13 10:09:38 +0000 Commit: Stefan Eßer CommitDate: 2022-03-04 19:47:02 +0000 qsort.c: prevent undefined behavior Mark Milliard has detected a case of undefined behavior with the LLVM UBSAN. The mandoc program called qsort with a==NULL and n==0, which is allowed by the POSIX standard. The qsort() in FreeBSD did not attempt to perform any accesses using the passed pointer for n==0, but it did add an offset to the pointer value, which is undefined behavior in case of a NULL pointer. This operation has no adverse effects on any achitecture supported by FreeBSD, but could be caught in more strict environments. After some discussion in the freebsd-current mail list, it was concluded that the case of a==NULL and n!=0 should still be caught by UBSAN (or cause a program abort due to an illegal access) in order to not hide errors in programs incorrectly invoking qsort(). Only the the case of a==NULL and n==0 should be fixed to not perform the undefined operation on a NULL pointer. This commit makes qsort() exit before reaching the point of potentially undefined behvior for the case n==0, but does not test the value of a, since the result will not depend on whether this pointer is NULL or an actual pointer to an array if n==0. The issue found by Mark Milliard in the whatis command has been reported to the upstream (OpenBSD) and has already been patched there. (cherry picked from commit d106f982a54cd299671ccad58bc456138a22ae7b) --- lib/libc/stdlib/qsort.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/libc/stdlib/qsort.c b/lib/libc/stdlib/qsort.c index cfd2d99025f0..015c648d633a 100644 --- a/lib/libc/stdlib/qsort.c +++ b/lib/libc/stdlib/qsort.c @@ -108,6 +108,8 @@ local_qsort(void *a, size_t n, size_t es, cmp_t *cmp, void *thunk) int cmp_result; int swap_cnt; + if (__predict_false(n == 0)) + return; loop: swap_cnt = 0; if (n < 7) {