Skip to content

【bugfix】riscv: strnlen: fix ZBB path overflow and SIZE_MAX fallback#340

Open
uestc-gr wants to merge 2 commits into
RVCK-Project:rvck-6.6from
uestc-gr:string-bugfix
Open

【bugfix】riscv: strnlen: fix ZBB path overflow and SIZE_MAX fallback#340
uestc-gr wants to merge 2 commits into
RVCK-Project:rvck-6.6from
uestc-gr:string-bugfix

Conversation

@uestc-gr

@uestc-gr uestc-gr commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

fixed: #339

功能正确性:原先的 ZBB 优化路径在 SIZE_MAX 或地址溢出情况下可能出现错误行为,需要强制回退到安全的通用实现。
边界安全:通过调整对齐边界和增加溢出检查,避免在极端输入下访问越界内存。
测试覆盖率:KUnit 增加了 SIZE_MAX 的测试,确保补丁中的回退逻辑在单元测试中得到验证,避免未来回归。

kunit测试结果

[ 8.764244] KTAP version 1
[ 8.764864] 1..2
[ 8.772373] KTAP version 1
[ 8.772967] # Subtest: string
[ 8.773905] # module: string_kunit
[ 8.774887] 1..27
[ 11.301053] # string_test_memset16: Test should be marked slow (runtime: 2.521287200s)
[ 11.308437] ok 1 string_test_memset16
[ 13.585242] # string_test_memset32: Test should be marked slow (runtime: 2.271439400s)
[ 13.590329] ok 2 string_test_memset32
[ 16.230879] # string_test_memset64: Test should be marked slow (runtime: 2.635710400s)
[ 16.235740] ok 3 string_test_memset64
[ 16.245111] ok 4 string_test_strlen
[ 16.284992] ok 5 string_test_strnlen
[ 16.292649] ok 6 string_test_strchr
[ 16.301462] ok 7 string_test_strnchr
[ 16.323942] ok 8 string_test_strrchr
[ 16.331929] ok 9 string_test_strspn
[ 16.342969] ok 10 string_test_strcmp
[ 16.351371] ok 11 string_test_strcmp_long_strings
[ 16.359479] ok 12 string_test_strncmp
[ 16.367889] ok 13 string_test_strncmp_long_strings
[ 16.375196] ok 14 string_test_strcasecmp
[ 16.383982] ok 15 string_test_strcasecmp_long_strings
[ 16.391826] ok 16 string_test_strncasecmp
[ 16.401226] ok 17 string_test_strncasecmp_long_strings
[ 16.416002] ok 18 string_test_strscpy
[ 16.423712] ok 19 string_test_strcat
[ 16.431317] ok 20 string_test_strncat
[ 16.439672] ok 21 string_test_strlcat
[ 16.448099] ok 22 string_test_strtomem
[ 16.456061] ok 23 string_test_memtostr
[ 16.464160] ok 24 string_bench_strlen # SKIP not enabled
[ 16.472060] ok 25 string_bench_strnlen # SKIP not enabled
[ 16.479556] ok 26 string_bench_strchr # SKIP not enabled
[ 16.487241] ok 27 string_bench_strrchr # SKIP not enabled
[ 16.488490] # string: pass:23 fail:0 skip:4 total:27
[ 16.489580] # Totals: pass:23 fail:0 skip:4 total:27

uestc-gr added 2 commits July 22, 2026 09:17
driver inclusion
category: bugfix
bugzilla: RVCK-Project#339

--------------------------------

This patch improves the RISC-V strnlen implementation:

- Add explicit fallback to generic path when count == SIZE_MAX,
  avoiding minu instruction misbehavior.
- Add overflow check for (s + count), ensuring safe fallback
  when address addition wraps around.
- Refactor aligned boundary calculation to use (s + count - 1),
  preventing word loads beyond the valid range.
- Add fast exit when all remaining bytes are within the first word.
- Simplify generic path loop with clearer pointer/count handling.

These changes fix potential off-by-one, overflow, and extreme
input bugs, while keeping ZBB optimization for normal cases.

Fixes: 5ba15d4 ("riscv: lib: add strnlen() implementation")
Signed-off-by: Gao Rui <gao.rui@zte.com.cn>
driver inclusion
category: bugfix
bugzilla: RVCK-Project#339

--------------------------------

Extend string_test_strnlen to validate strnlen behavior with
SIZE_MAX input:

- Add explicit test case for strnlen(s, SIZE_MAX).
- Ensure fallback to generic path returns correct length when
  string has no NUL terminator.
- Complements existing tests for non-terminated strings and
  boundary conditions.

This improves KUnit coverage for extreme inputs and verifies
the correctness of the new fallback logic in strnlen.S.

Signed-off-by: Gao Rui <gao.rui@zte.com.cn>
@github-actions

github-actions Bot commented Jul 22, 2026

Copy link
Copy Markdown

开始测试 log: https://github.com/RVCK-Project/rvck/actions/runs/29883038080

参数解析结果
args value
repository RVCK-Project/rvck
head ref pull/340/head
base ref rvck-6.6
LAVA repo RVCK-Project/lavaci
LAVA hardware ['qemu']
LAVA Testcase path lava-testcases/common-test/ltp/ltp.yaml
need run job kunit-test,kernel-build,check-patch,lava-trigger

测试完成

详细结果:
check result
kunit-test success
kernel-build success
check-patch success
lava-trigger-qemu success
lava-trigger-sg2042 skipped
lava-trigger-k1 skipped
lava-trigger-lpi4a skipped

Kunit Test Result

[01:29:44] Testing complete. Ran 482 tests: passed: 465, skipped: 17

Kernel Build Result

Check Patch Result

Total Errors 0
Total Warnings 2

LAVA Check (qemu)

args value
testcase_repo RVCK-Project/lavaci
lava_template lava-job-template/qemu/qemu-ltp.yaml
testcase_path lava-testcases/common-test/ltp/ltp.yaml
kernel_download_url http://10.30.190.110/openEuler-RISC-V/RVCK/OERV-RVCI/RVCK-Project/rvck/340_29883038080_1/Image
initramfs_download_url http://10.30.190.110/openEuler-RISC-V/RVCK/OERV-RVCI/RVCK-Project/rvck/340_29883038080_1/initramfs.img
rootfs_download_url https://fast-mirror.isrc.ac.cn/openeuler-sig-riscv/openEuler-RISC-V/RVCK/openEuler24.03-LTS-SP1/openeuler-rootfs.img.zst
testcase_ref main
testitem_name RVCK-Project_rvck_pull_request_target_340__common-test_qemu

result: Lava check done!

@uestc-gr

Copy link
Copy Markdown
Contributor Author

PR已完成请老师评审

@unicornx

Copy link
Copy Markdown

这是 rvck 独有的问题还是主线也存在的问题,如果主线也存在的话,我建议先提交给主线合入后再 pick 到这里,这样可以请上游的 maintainer 协助更详细的审查。@uestc-gr

@unicornx unicornx added the ZTE label Jul 22, 2026
@uestc-gr

Copy link
Copy Markdown
Contributor Author

这是 rvck 独有的问题还是主线也存在的问题,如果主线也存在的话,我建议先提交给主线合入后再 pick 到这里,这样可以请上游的 maintainer 协助更详细的审查。@uestc-gr

主线也存在问题,这个问题比较紧急且重要,会导致系统找不到lvm磁盘设备,进而安装失败或启动失败,主线修改周期较长,我测试过这个修改性能上可能差一点,但至少功能应该没有问题,我想先合入rvck解决启动问题,后面再回合主线的正式修改@unicornx

@sterling-teng

Copy link
Copy Markdown
Contributor

这是 rvck 独有的问题还是主线也存在的问题,如果主线也存在的话,我建议先提交给主线合入后再 pick 到这里,这样可以请上游的 maintainer 协助更详细的审查。@uestc-gr

主线也存在问题,这个问题比较紧急且重要,会导致系统找不到lvm磁盘设备,进而安装失败或启动失败,主线修改周期较长,我测试过这个修改性能上可能差一点,但至少功能应该没有问题,我想先合入rvck解决启动问题,后面再回合主线的正式修改@unicornx

你的补丁改了nolibc,代码影响范围比较大。这种情况,我建议同时提交邮件列表,我们想了解下上游社区维护该子系统maintainer的看法,以此来评估是否合入。

BTW,这个pr要不先进openruyi内核集成测试下? @RevySR

@unicornx

unicornx commented Jul 22, 2026

Copy link
Copy Markdown

你的补丁改了nolibc,代码影响范围比较大。这种情况,我建议同时提交邮件列表,我们想了解下上游社区维护该子系统maintainer的看法,以此来评估是否合入。

我也赞成同时提交上游,如果上游 maintainer 一接受,我们这可以提前就合入 rvck,不用等上游的 master pick。这样也快。而且这个改动我看本身改动不大,如果没啥问题,上游 review 也快的,你觉得如何? @uestc-gr

我同时也想到的是,如果我们提前合入了,等上游 master 正式 pick 了,为了让 rvck 看得更好,我们或许可以再做一次 revert + repick(上游master 版本)的操作,这样会更完美些。

@uestc-gr

Copy link
Copy Markdown
Contributor Author

你的补丁改了nolibc,代码影响范围比较大。这种情况,我建议同时提交邮件列表,我们想了解下上游社区维护该子系统maintainer的看法,以此来评估是否合入。

我也赞成同时提交上游,如果上游 maintainer 一接受,我们这可以提前就合入 rvck,不用等上游的 master pick。这样也快。而且这个改动我看本身改动不大,如果没啥问题,上游 review 也快的,你觉得如何? @uestc-gr

我同时也想到的是,如果我们提前合入了,等上游 master 正式 pick 了,为了让 rvck 看得更好,我们或许可以再做一次 revert + repick(上游master 版本)的操作,这样会更完美些。

好的,我们先推L0看看

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

riscv: strnlen: fix ZBB path overflow and SIZE_MAX fallback

3 participants