Re: Dangerous code in cpumask_of_cpu?

[Johannes Weiner]

[ fixed christoph's address in cc]

Johannes Weiner <hannes@xxxxxxxxxxxx> writes:

>> I guess because we dereference it immediately again, the location is not
>> clobbered yet.  At least in my test case, gcc assembled it to code that
>> puts the address in eax and derefences it immediately, before eax is
>> reused:
>
> Gee, just ignore this bs.  The address is in eax, not the value.

My theory was half-right.  Since the code is a macro, there is no call
and hence no stack clean-up.  And although it is UB, it works correctly
as the value is not yet clobbered when we access it again.  Converting
foo to a macro yields this:

        movl    $42, -8(%ebp)
        leal    -8(%ebp), %eax
        movl    (%eax), %eax
	...
	ret

gcc only emits a warning if the scope we leak a local address from is
that of a function.

	Hannes
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/