File 0181-erts-Fix-pointer-aliasing-UB-in-hashmap-in... of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 0181-erts-Fix-pointer-aliasing-UB-in-hashmap-internal-sor.patch of Package erlang (Revision dbf46e61b8023f4ac6ad2ef5582bedfe)

Currently displaying revision dbf46e61b8023f4ac6ad2ef5582bedfe , Show latest

From d0c9f96c44372e70a7d95c3b5303bb628280ca80 Mon Sep 17 00:00:00 2001
From: Sverker Eriksson <sverker@erlang.org>
Date: Wed, 26 May 2021 14:38:15 +0200
Subject: [PATCH 1/3] erts: Fix pointer aliasing UB in hashmap internal sort

Symptom seen in GH-4846:

Failed map operation when building OTP with gcc opt "-flto".
	Function: compile/3
	leex.erl: internal error in pass beam_kernel_to_ssa:
	exception error: bad key: 1
	  in function  map_get/2

Problem:
As erts_qsort_swap used UWord pointers while real sort key was Uint32 hx.
gcc -flto did aggressive optimization assuming strict aliasing
resulting in calls to the compare function being optimized away
when the pointer arguments were the same as before assuming
the same result as before.

The outcome was a completely invalid sorting result
which caused maps_get not finding existing keys.

Solution:
Use memcpy() which should be immune against strict aliasing.
---
 erts/emulator/beam/utils.c | 28 +++++++++-------------------
 1 file changed, 9 insertions(+), 19 deletions(-)

diff --git a/erts/emulator/beam/utils.c b/erts/emulator/beam/utils.c
index 7df04420da..3142564787 100644
--- a/erts/emulator/beam/utils.c
+++ b/erts/emulator/beam/utils.c
@@ -5191,31 +5191,22 @@ static void erts_qsort_swap(size_t item_size,
                             void* iptr,
                             void* jptr)
 {
-    if (item_size % sizeof(UWord) == 0) {
+    ASSERT(item_size % sizeof(UWord) == 0);
+
+    if (iptr != jptr) {
         /* Do it word by word */
         UWord* iwp = (UWord*) iptr;
         UWord* jwp = (UWord*) jptr;
 	size_t cnt;
         for (cnt = item_size / sizeof(UWord); cnt; cnt--) {
-            UWord tmp = *jwp;
-            *jwp = *iwp;
-            *iwp = tmp;
+            UWord tmp;
+	    sys_memcpy(&tmp, jwp, sizeof(UWord));
+	    sys_memcpy(jwp, iwp, sizeof(UWord));
+	    sys_memcpy(iwp, &tmp, sizeof(UWord));
 	    jwp++;
             iwp++;
         }
     }
-    else {
-	/* Do it byte by byte (this can be optimized) */
-	byte* ibyteptr = (byte*)iptr;
-	byte* jbyteptr = (byte*)jptr;
-	for (size_t i = 0; i < item_size; i++) {
-	    char tmp = jbyteptr[0];
-	    jbyteptr[0] = ibyteptr[0];
-	    ibyteptr[0] = tmp;
-	    jbyteptr++;
-	    ibyteptr++;
-	}
-    }
 }
 
 /* **Important Note**
@@ -5297,9 +5288,8 @@ erts_qsort_partion_array(byte *base,
         byte * pivot_part_start = curr - item_size;
         byte * pivot_part_end = curr + item_size;
         byte * last_part_start = second_part_start;
-        if (base != pivot_part_start) {
-            erts_qsort_swap(item_size, base, pivot_part_start);
-        }
+
+	erts_qsort_swap(item_size, base, pivot_part_start);
 
         while (pivot_part_end != last_part_start) {
             int compare_res =
-- 
2.26.2

Places

File 0181-erts-Fix-pointer-aliasing-UB-in-hashmap-internal-sor.patch of Package erlang (Revision dbf46e61b8023f4ac6ad2ef5582bedfe)

Places