[DPDK/other Bug 1726] possible overrun bugs in soring found with LTO

[bugzilla at dpdk.org]

https://bugs.dpdk.org/show_bug.cgi?id=1726

            Bug ID: 1726
           Summary: possible overrun bugs in soring found with LTO
           Product: DPDK
           Version: unspecified
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: other
          Assignee: dev at dpdk.org
          Reporter: stephen at networkplumber.org
  Target Milestone: ---

Enabling LTO in build allows compiler to detect more bugs such as out of bounds
references inside libraries. Several warnings in soring

In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 128 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |                  ^
In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 160 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |                  ^
In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 192 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |                  ^
In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 224 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |                  ^
In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 256 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |                  ^
In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 288 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |                  ^
In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 320 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |                  ^
In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 352 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |                  ^
In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 384 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |                  ^
In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 416 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |                  ^
In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 448 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |                  ^
In function ‘__rte_ring_dequeue_elems_128’,
    inlined from ‘__rte_ring_do_dequeue_elems’ at
../lib/ring/rte_ring_elem_pvt.h:279:3,
    inlined from ‘soring_dequeue’ at ../lib/ring/soring.c:315:3,
    inlined from ‘rte_soring_dequeue_bulk’ at ../lib/ring/soring.c:552:9,
    inlined from ‘test_soring_stages’ at ../app/test/test_soring.c:181:14:
../lib/ring/rte_ring_elem_pvt.h:250:25: warning: writing 32 bytes into a region
of size 0 [-Wstringop-overflow=]
  250 |                         memcpy((obj + i), (const void *)(ring + idx),
32);
      |                         ^
../app/test/test_soring.c: In function ‘test_soring_stages’:
../app/test/test_soring.c:157:18: note: at offset 480 into destination object
‘dequeued_objs’ of size 128
  157 |         uint32_t dequeued_objs[32];
      |

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/dev/attachments/20250617/a8569083/attachment-0001.htm>