offset_of is unsound #1415

RalfJung · 2021-04-03T17:31:40Z

The macro at

Line 210 in 6af11c1

macro_rules! offset_of {

is unsound and causes UB due to using * on a NULL pointer. See the reference for details.

The memoffset crate provides a version of this macro that avoids UB (on older versions of rustc, this is not always possible, so it falls back to the 'least incorrect' version when needed).

The text was updated successfully, but these errors were encountered:

1416: Use memoffset::offset_of instead of homegrown macro r=asomers a=asomers The homegrown macro was fine in 2016, but at some point it technically became UB. The memoffset crate does the same thing, but avoids UB when using rustc 1.51.0 or later. Fixes #1415 Co-authored-by: Alan Somers <[email protected]>

The homegrown macro was fine in 2016, but at some point it technically became UB. The memoffset crate does the same thing, but avoids UB when using rustc 1.51.0 or later. Fixes nix-rust#1415

unistd: Increase maximum passwd/group buffer to 1MB We have one UNIX group that contains most of our users whose size is about 20 kB, so `Group::from_name` is failing with ERANGE. The discussion on PR nix-rust#864 suggests that 1 MB is a reasonable maximum - it follows what FreeBSD's libc does. (glibc appears to have no maximum on the _r function and will just double the buffer until malloc fails, but that's not particularly Rusty.) Use memoffset::offset_of instead of homegrown macro The homegrown macro was fine in 2016, but at some point it technically became UB. The memoffset crate does the same thing, but avoids UB when using rustc 1.51.0 or later. Fixes nix-rust#1415 Check all tests in CI Travis didn't compile check tests on platforms that couldn't run tests in CI, so they bitrotted. Let's see how bad they are. Most annoyingly, 32-bit Android defines mode_t as 16 bits, but stat.st_mode as 32-bits. Fix spurious errors using `sendmmsg` with multiple cmsgs Before this fix, the buffer that holds cmsgs may move due to the resize() call. That causes msg_hdr pointing to invalid memory, which ends up breaking the sendmmsg() call, resulting in EINVAL. This change fixes it by avoiding re-allocating the buffers. Support TIMESTAMPNS for linux

unistd: Increase maximum passwd/group buffer to 1MB We have one UNIX group that contains most of our users whose size is about 20 kB, so `Group::from_name` is failing with ERANGE. The discussion on PR nix-rust#864 suggests that 1 MB is a reasonable maximum - it follows what FreeBSD's libc does. (glibc appears to have no maximum on the _r function and will just double the buffer until malloc fails, but that's not particularly Rusty.) Use memoffset::offset_of instead of homegrown macro The homegrown macro was fine in 2016, but at some point it technically became UB. The memoffset crate does the same thing, but avoids UB when using rustc 1.51.0 or later. Fixes nix-rust#1415 Check all tests in CI Travis didn't compile check tests on platforms that couldn't run tests in CI, so they bitrotted. Let's see how bad they are. Most annoyingly, 32-bit Android defines mode_t as 16 bits, but stat.st_mode as 32-bits. Fix spurious errors using `sendmmsg` with multiple cmsgs Before this fix, the buffer that holds cmsgs may move due to the resize() call. That causes msg_hdr pointing to invalid memory, which ends up breaking the sendmmsg() call, resulting in EINVAL. This change fixes it by avoiding re-allocating the buffers. Support TIMESTAMPNS for linux unistd: Increase maximum passwd/group buffer to 1MB We have one UNIX group that contains most of our users whose size is about 20 kB, so `Group::from_name` is failing with ERANGE. The discussion on PR nix-rust#864 suggests that 1 MB is a reasonable maximum - it follows what FreeBSD's libc does. (glibc appears to have no maximum on the _r function and will just double the buffer until malloc fails, but that's not particularly Rusty.) Use memoffset::offset_of instead of homegrown macro The homegrown macro was fine in 2016, but at some point it technically became UB. The memoffset crate does the same thing, but avoids UB when using rustc 1.51.0 or later. Fixes nix-rust#1415 Check all tests in CI Travis didn't compile check tests on platforms that couldn't run tests in CI, so they bitrotted. Let's see how bad they are. Most annoyingly, 32-bit Android defines mode_t as 16 bits, but stat.st_mode as 32-bits. Fix spurious errors using `sendmmsg` with multiple cmsgs Before this fix, the buffer that holds cmsgs may move due to the resize() call. That causes msg_hdr pointing to invalid memory, which ends up breaking the sendmmsg() call, resulting in EINVAL. This change fixes it by avoiding re-allocating the buffers. Support TIMESTAMPNS for linux fix bug missing octothorpe

The homegrown macro was fine in 2016, but at some point it technically became UB. The memoffset crate does the same thing, but avoids UB when using rustc 1.51.0 or later. Fixes #1415

asomers mentioned this issue Apr 4, 2021

Use memoffset::offset_of instead of homegrown macro #1416

Merged

bors bot closed this as completed in 987c8a6 Apr 4, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

offset_of is unsound #1415

offset_of is unsound #1415

RalfJung commented Apr 3, 2021

offset_of is unsound #1415

offset_of is unsound #1415

Comments

RalfJung commented Apr 3, 2021