laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43150?usp=email )
Change subject: linuxlist: fix false-positive UBSan misaligned-access reports
......................................................................
linuxlist: fix false-positive UBSan misaligned-access reports
llist_for_each_entry() and its variants terminate by comparing
&pos->member against head. Once a full traversal reaches the end of a
non-empty list (or the list is empty to begin with), pos becomes a pure
container_of()-computed sentinel address that was never a real object
of typeof(*pos), only ever the plain 'struct llist_head *' passed in as
head. Forming 'pos->member' on that address requires pos to satisfy
the alignment of typeof(*pos), which the sentinel does not necessarily
provide (e.g. embedded struct osmo_timer_list/gprs_nsvc on 32-bit ARM
with a 64-bit time_t need 8-byte alignment, while head itself is only
pointer-aligned) - tripping -fsanitize=alignment even though no real
object is ever misaligned or dereferenced.
Add __llist_member(), computing the same address via 'char *'
pointer arithmetic and an explicit cast to 'struct llist_head *', which
carries no alignment requirement of its own. Use it for the loop
termination check, the "next" pointer computation, and the prefetch()
calls (dereferencing the returned struct llist_head * still only
requires pointer alignment, so prefetch() keeps working exactly
as before without reintroducing the false positive).
Change-Id: I0424e76e76d8aa9402bd1a5aefe789de16e72fae
Related: OS#7036, OS#6858
---
M include/osmocom/core/linuxlist.h
1 file changed, 33 insertions(+), 19 deletions(-)
Approvals:
Jenkins Builder: Verified
laforge: Looks good to me, approved
pespin: Looks good to me, approved
diff --git a/include/osmocom/core/linuxlist.h b/include/osmocom/core/linuxlist.h
index 8c8b1bc..06627fb 100644
--- a/include/osmocom/core/linuxlist.h
+++ b/include/osmocom/core/linuxlist.h
@@ -218,6 +218,20 @@
#define llist_entry(ptr, type, member) \
container_of(ptr, type, member)
+/*! Compute the address of the llist_head member within *pos, without
+ * forming a 'pos->member' expression.
+ *
+ * This exists so llist_for_each_entry() and friends can test for the
+ * end of the list (where 'pos' is a container_of()-computed address
+ * that was never a real object of typeof(*pos), only ever a
+ * 'struct llist_head *') without tripping -fsanitize=alignment: a
+ * 'pos->member' access requires 'pos' itself to satisfy the alignment
+ * of typeof(*pos), which the end-of-list address does not necessarily
+ * do, while plain 'char *' pointer arithmetic has no such requirement.
+ */
+#define __llist_member(pos, member) \
+ ((struct llist_head *)((char *)(pos) + offsetof(typeof(*(pos)), member)))
+
/*! Get the first element from a linked list.
* \param ptr the list head to take the element from.
* \param type the type of the struct this is embedded in.
@@ -308,10 +322,10 @@
*/
#define llist_for_each_entry(pos, head, member) \
for (pos = llist_entry((head)->next, typeof(*pos), member), \
- prefetch(pos->member.next); \
- &pos->member != (head); \
- pos = llist_entry(pos->member.next, typeof(*pos), member), \
- prefetch(pos->member.next))
+ prefetch(__llist_member(pos, member)->next); \
+ __llist_member(pos, member) != (head); \
+ pos = llist_entry(__llist_member(pos, member)->next, typeof(*pos), member), \
+ prefetch(__llist_member(pos, member)->next))
/*! Iterate backwards over a linked list of a given type.
* \param pos the 'type *' to use as a loop counter.
@@ -320,10 +334,10 @@
*/
#define llist_for_each_entry_reverse(pos, head, member) \
for (pos = llist_entry((head)->prev, typeof(*pos), member), \
- prefetch(pos->member.prev); \
- &pos->member != (head); \
- pos = llist_entry(pos->member.prev, typeof(*pos), member), \
- prefetch(pos->member.prev))
+ prefetch(__llist_member(pos, member)->prev); \
+ __llist_member(pos, member) != (head); \
+ pos = llist_entry(__llist_member(pos, member)->prev, typeof(*pos), member), \
+ prefetch(__llist_member(pos, member)->prev))
/*! Iterate over a linked list of a given type,
* continuing after an existing point.
@@ -333,10 +347,10 @@
*/
#define llist_for_each_entry_continue(pos, head, member) \
for (pos = llist_entry(pos->member.next, typeof(*pos), member), \
- prefetch(pos->member.next); \
- &pos->member != (head); \
- pos = llist_entry(pos->member.next, typeof(*pos), member), \
- prefetch(pos->member.next))
+ prefetch(__llist_member(pos, member)->next); \
+ __llist_member(pos, member) != (head); \
+ pos = llist_entry(__llist_member(pos, member)->next, typeof(*pos), member), \
+ prefetch(__llist_member(pos, member)->next))
/*! Iterate over llist of given type, safe against removal of llist entry.
* \param pos the 'type *' to use as a loop counter.
@@ -346,9 +360,9 @@
*/
#define llist_for_each_entry_safe(pos, n, head, member) \
for (pos = llist_entry((head)->next, typeof(*pos), member), \
- n = llist_entry(pos->member.next, typeof(*pos), member); \
- &pos->member != (head); \
- pos = n, n = llist_entry(n->member.next, typeof(*n), member))
+ n = llist_entry(__llist_member(pos, member)->next, typeof(*pos), member); \
+ __llist_member(pos, member) != (head); \
+ pos = n, n = llist_entry(__llist_member(n, member)->next, typeof(*n), member))
/*! Iterate over an rcu-protected llist.
* \param pos the llist_head to use as a loop counter.
@@ -378,11 +392,11 @@
*/
#define llist_for_each_entry_rcu(pos, head, member) \
for (pos = llist_entry((head)->next, typeof(*pos), member), \
- prefetch(pos->member.next); \
- &pos->member != (head); \
- pos = llist_entry(pos->member.next, typeof(*pos), member), \
+ prefetch(__llist_member(pos, member)->next); \
+ __llist_member(pos, member) != (head); \
+ pos = llist_entry(__llist_member(pos, member)->next, typeof(*pos), member), \
({ smp_read_barrier_depends(); 0;}), \
- prefetch(pos->member.next))
+ prefetch(__llist_member(pos, member)->next))
/*! Iterate over an rcu-protected llist, continuing after existing point.
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43150?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: I0424e76e76d8aa9402bd1a5aefe789de16e72fae
Gerrit-Change-Number: 43150
Gerrit-PatchSet: 3
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43151?usp=email )
Change subject: linuxlist: drop no-op prefetch() calls
......................................................................
linuxlist: drop no-op prefetch() calls
prefetch() has always been a no-op stub in this header so calling
it buys nothing at runtime. Drop all call sites and remove the
now-dead stub itself.
The macro was copied over from the Linux kernel back when
linuxlist.h was first added in 2010 [1], where prefetch() was a real,
arch-specific cache prefetch hint at the time. Upstream itself later
dropped prefetching from the regular list iterators in 2011 [2].
Change-Id: Id84973330df44b4efdd1bd85e4b7c3cb88642f92
Related: [1] ec8b4501c7 ("intial checkin of the libosmocore project")
Related: [2] e66eed651fd1 ("list: remove prefetching from regular list iterators")
Related: OS#7036, OS#6858
---
M include/osmocom/core/linuxlist.h
1 file changed, 17 insertions(+), 30 deletions(-)
Approvals:
laforge: Looks good to me, approved; Verified
pespin: Looks good to me, but someone else must approve
diff --git a/include/osmocom/core/linuxlist.h b/include/osmocom/core/linuxlist.h
index 06627fb..49d347e 100644
--- a/include/osmocom/core/linuxlist.h
+++ b/include/osmocom/core/linuxlist.h
@@ -22,8 +22,6 @@
#define inline __inline__
#endif
-static inline void prefetch(const void *x) {;}
-
/*! Cast a member of a structure out to the containing structure.
* \param[in] ptr the pointer to the member.
* \param[in] type the type of the container struct this is embedded in.
@@ -283,15 +281,13 @@
* \param head the head of the list over which to iterate.
*/
#define llist_for_each(pos, head) \
- for (pos = (head)->next, prefetch(pos->next); pos != (head); \
- pos = pos->next, prefetch(pos->next))
+ for (pos = (head)->next; pos != (head); pos = pos->next)
-/*! Iterate over a linked list (no prefetch).
+/*! Iterate over a linked list.
* \param pos the llist_head to use as a loop counter.
* \param head the head of the list over which to iterate.
*
- * This variant differs from llist_for_each() in that it's the
- * simplest possible llist iteration code, no prefetching is done.
+ * Equivalent to llist_for_each(); kept for API compatibility.
* Use this for code that knows the llist to be very short (empty
* or 1 entry) most of the time.
*/
@@ -303,8 +299,7 @@
* \param head the head of the list over which to iterate.
*/
#define llist_for_each_prev(pos, head) \
- for (pos = (head)->prev, prefetch(pos->prev); pos != (head); \
- pos = pos->prev, prefetch(pos->prev))
+ for (pos = (head)->prev; pos != (head); pos = pos->prev)
/*! Iterate over a linked list, safe against removal of llist entry.
* \param pos the llist_head to use as a loop counter.
@@ -321,11 +316,9 @@
* \param member the name of the llist_head within the struct pos.
*/
#define llist_for_each_entry(pos, head, member) \
- for (pos = llist_entry((head)->next, typeof(*pos), member), \
- prefetch(__llist_member(pos, member)->next); \
+ for (pos = llist_entry((head)->next, typeof(*pos), member); \
__llist_member(pos, member) != (head); \
- pos = llist_entry(__llist_member(pos, member)->next, typeof(*pos), member), \
- prefetch(__llist_member(pos, member)->next))
+ pos = llist_entry(__llist_member(pos, member)->next, typeof(*pos), member))
/*! Iterate backwards over a linked list of a given type.
* \param pos the 'type *' to use as a loop counter.
@@ -333,11 +326,9 @@
* \param member the name of the llist_head within the struct pos.
*/
#define llist_for_each_entry_reverse(pos, head, member) \
- for (pos = llist_entry((head)->prev, typeof(*pos), member), \
- prefetch(__llist_member(pos, member)->prev); \
+ for (pos = llist_entry((head)->prev, typeof(*pos), member); \
__llist_member(pos, member) != (head); \
- pos = llist_entry(__llist_member(pos, member)->prev, typeof(*pos), member), \
- prefetch(__llist_member(pos, member)->prev))
+ pos = llist_entry(__llist_member(pos, member)->prev, typeof(*pos), member))
/*! Iterate over a linked list of a given type,
* continuing after an existing point.
@@ -346,11 +337,9 @@
* \param member the name of the llist_head within the struct pos.
*/
#define llist_for_each_entry_continue(pos, head, member) \
- for (pos = llist_entry(pos->member.next, typeof(*pos), member), \
- prefetch(__llist_member(pos, member)->next); \
+ for (pos = llist_entry(pos->member.next, typeof(*pos), member); \
__llist_member(pos, member) != (head); \
- pos = llist_entry(__llist_member(pos, member)->next, typeof(*pos), member), \
- prefetch(__llist_member(pos, member)->next))
+ pos = llist_entry(__llist_member(pos, member)->next, typeof(*pos), member))
/*! Iterate over llist of given type, safe against removal of llist entry.
* \param pos the 'type *' to use as a loop counter.
@@ -369,8 +358,8 @@
* \param head the head of the list over which to iterate.
*/
#define llist_for_each_rcu(pos, head) \
- for (pos = (head)->next, prefetch(pos->next); pos != (head); \
- pos = pos->next, ({ smp_read_barrier_depends(); 0;}), prefetch(pos->next))
+ for (pos = (head)->next; pos != (head); \
+ pos = pos->next, ({ smp_read_barrier_depends(); 0;}))
#define __llist_for_each_rcu(pos, head) \
for (pos = (head)->next; pos != (head); \
@@ -391,12 +380,10 @@
* \param member the name of the llist_struct within the struct.
*/
#define llist_for_each_entry_rcu(pos, head, member) \
- for (pos = llist_entry((head)->next, typeof(*pos), member), \
- prefetch(__llist_member(pos, member)->next); \
- __llist_member(pos, member) != (head); \
+ for (pos = llist_entry((head)->next, typeof(*pos), member); \
+ __llist_member(pos, member) != (head); \
pos = llist_entry(__llist_member(pos, member)->next, typeof(*pos), member), \
- ({ smp_read_barrier_depends(); 0;}), \
- prefetch(__llist_member(pos, member)->next))
+ ({ smp_read_barrier_depends(); 0;}))
/*! Iterate over an rcu-protected llist, continuing after existing point.
@@ -404,8 +391,8 @@
* \param head the head of the list over which to iterate.
*/
#define llist_for_each_continue_rcu(pos, head) \
- for ((pos) = (pos)->next, prefetch((pos)->next); (pos) != (head); \
- (pos) = (pos)->next, ({ smp_read_barrier_depends(); 0;}), prefetch((pos)->next))
+ for ((pos) = (pos)->next; (pos) != (head); \
+ (pos) = (pos)->next, ({ smp_read_barrier_depends(); 0;}))
/*! Count number of llist items by iterating.
* \param head the llist head to count items of.
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43151?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: Id84973330df44b4efdd1bd85e4b7c3cb88642f92
Gerrit-Change-Number: 43151
Gerrit-PatchSet: 4
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Attention is currently required from: pespin.
lynxis lazus has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/osmo-msc/+/43482?usp=email )
Change subject: libvlr: fix linter issues
......................................................................
Patch Set 1:
(1 comment)
File src/libvlr/vlr_access_req_fsm.c:
https://gerrit.osmocom.org/c/osmo-msc/+/43482/comment/15816bb8_72915dd0?usp… :
PS1, Line 790: .in_event_mask = TODO,
> how is this even compiling? 😮What about: […]
there is a huge #if 0
--
To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43482?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-msc
Gerrit-Branch: master
Gerrit-Change-Id: I99f424b196e3b583716d05e77dcd03b907920af1
Gerrit-Change-Number: 43482
Gerrit-PatchSet: 1
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Comment-Date: Tue, 01 Sep 2026 08:09:00 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>