https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127875
Bug ID: 127875
Summary: __bdos(p, 0) returns 0 after container_of from a
counted_by FAM
Product: gcc
Version: 15.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: tree-optimization
Assignee: unassigned at gcc dot gnu.org
Reporter: spender at grsecurity dot net
Target Milestone: ---
When GCC encounters a container_of construct involving a counted_by flexible
array, __builtin_dynamic_object_size(p, 0) incorrectly returns 0 for the
recovered enclosing object, even though a direct query through the original
pointer returns the correct size.
This issue is currently visible in Linux kernels >= 7.1 enabling
CONFIG_FORTIFY_SOURCE with GCC >= 15, encountered but not yet diagnosed by
reports like:
https://lore.kernel.org/all/[email protected]/
showing a false-positive FORTIFY_SOURCE report on a memcpy against a known-size
field in a structure (both source and destination objects/arrays are the same
types). We ran into the same issue ourselves (with GCC 15.1) running the same
kernel selftests mentioned in the above report.
The false-positive report gets produced from the line:
memcpy(dev->broadcast, port_dev->broadcast, length);
and is reported as:
memcpy: detected buffer overflow: 4 byte write of buffer size 0
The specific upstream Linux commit which introduced the container_of use which
made the bug visible/triggerable was:
9027497a25e3 team: use netdev_from_priv()
I've checked other existing bug reports and believe this is a separate issue
from both bug 127234 and bug 126975.
I've confirmed the issue exists in GCC since the introduction of __counted_by
in 15.0, and have reproduced it with 15, 16, and trunk.
I've provided a minimal reproducer of the issue at:
https://godbolt.org/z/5cEvKrdh4 and have confirmed clang produces the correct
result for this case.
This is my first bugzilla report in many years, so apologies if anything needed
is missing, I'm happy to correct or elaborate on anything.
