Re: [PATCH] riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
From: shao.mingyin
Date: Thu Sep 10 2026 - 22:49:17 EST
Hi Paul,
Friendly ping on this one - just checking whether there are any comments,
or if it needs any changes before it can be picked up.
Quick recap: commit 5d588c684833 ("riscv: lib: Fix ZBB strnlen reading
past count boundary"), released in v7.1.10/7.2, introduced a regression
where strnlen(s, SIZE_MAX) returns 8 for any 8+-byte aligned string:
the wrap-around boundary (s + count - 1) & ~7 folds back to s - 8, so
the pre-loop guard always passes. This truncates names built through
FORTIFY strcat/strlcat - e.g. device-mapper's sysfs name "live-base"
becomes "live-bas", which broke blivet/anaconda installs on RISC-V.
The fix stays entirely inside the ZBB path - no fallback, just 2 extra
instructions - by saturating the boundary instead of letting it wrap.
Normal counts are unaffected.
Verified with a dedicated test module (all cases pass) and a 6098-case
semantic simulation comparing the original/current/fixed variants
(0 failures, 0 faults). Happy to rebase onto riscv fixes if preferred.
Thanks,
Shao Mingyin