From 7a887dd537cd00fe3cdf42b788b3f0e3b430b0ed Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Mon, 5 Oct 2020 17:30:05 -0300 Subject: posix: Fix -Warray-bounds instances building timer_create [BZ #26687] GCC 11 -Warray-bounds triggers invalid warnings when building Linux timer_create.c: ../sysdeps/unix/sysv/linux/timer_create.c: In function '__timer_create_new': ../sysdeps/unix/sysv/linux/timer_create.c:83:17: warning: array subscript 'struct timer[0]' is partly outside array bounds of 'unsigned char[8]' [-Warray-bounds] 83 | newp->sigev_notify = (evp != NULL | ^~ ../sysdeps/unix/sysv/linux/timer_create.c:59:47: note: referencing an object of size 8 allocated by 'malloc' 59 | struct timer *newp = (struct timer *) malloc (offsetof (struct timer, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 60 | thrfunc)); | ~~~~~~~~~ The struct allocated for !SIGEV_THREAD timers only requires two 'int' fields (sigev_notify and ktimerid) and the offsetof trick tries minimize the memory usage by only allocation the required size. However, although the resulting size is suffice for !SIGEV_THREAD time, accessing the partially allocated object is error-prone and UB. This patch fixes both issues by embedding the information whether the timer if a SIGEV_THREAD in the returned 'timer_t'. For !SIGEV_THREAD, the resulting 'timer_t' is the returned kernel timer identifer (kernel_timer_t), while for SIGEV_THREAD it uses the fact malloc returns at least _Alignof (max_align_t) pointers plus that valid kernel_timer_t are always positive to set MSB bit of the returned 'timer_t' to indicate the timer handles a SIGEV_THREAD. It allows to remove the memory allocation for !SIGEV_THREAD and also remove the 'sigev_notify' field from 'struct timer'. Checked on x86_64-linux-gnu and i686-linux-gnu. --- sysdeps/unix/sysv/linux/timer_delete.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) (limited to 'sysdeps/unix/sysv/linux/timer_delete.c') diff --git a/sysdeps/unix/sysv/linux/timer_delete.c b/sysdeps/unix/sysv/linux/timer_delete.c index c240c06139..c8a5f101b4 100644 --- a/sysdeps/unix/sysv/linux/timer_delete.c +++ b/sysdeps/unix/sysv/linux/timer_delete.c @@ -32,15 +32,15 @@ int timer_delete (timer_t timerid) { #undef timer_delete - struct timer *kt = (struct timer *) timerid; - - /* Delete the kernel timer object. */ - int res = INLINE_SYSCALL (timer_delete, 1, kt->ktimerid); + kernel_timer_t ktimerid = timerid_to_kernel_timer (timerid); + int res = INLINE_SYSCALL_CALL (timer_delete, ktimerid); if (res == 0) { - if (kt->sigev_notify == SIGEV_THREAD) + if (timer_is_sigev_thread (timerid)) { + struct timer *kt = timerid_to_timer (timerid); + /* Remove the timer from the list. */ pthread_mutex_lock (&__active_timer_sigev_thread_lock); if (__active_timer_sigev_thread == kt) @@ -58,10 +58,9 @@ timer_delete (timer_t timerid) prevp = prevp->next; } pthread_mutex_unlock (&__active_timer_sigev_thread_lock); - } - /* Free the memory. */ - (void) free (kt); + free (kt); + } return 0; } -- cgit v1.2.3-70-g09d2