Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ubsan errors #7302

Open
Mindavi opened this issue Nov 14, 2022 · 0 comments
Open

ubsan errors #7302

Mindavi opened this issue Nov 14, 2022 · 0 comments

Comments

@Mindavi
Copy link
Contributor

Mindavi commented Nov 14, 2022

Describe the bug

I've built Nix with UBSAN on my system (added NIX_CFLAGS_COMPILE = -fstack-protector-all -fsanitize=undefined -fsanitize-recover=all -fno-common -fno-omit-frame-pointer -O1 -fno-optimize-sibling-calls to be precise). Whenever I start a build I get these errors:

src/libexpr/eval.cc:2579:23: runtime error: member call on address 0x7f2108816340 which does not point to an object of type 'BaseSetting'
0x7f2108816340: note: object has invalid vptr
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              invalid vptr
src/libexpr/eval.cc:2579:53: runtime error: member call on address 0x7f21088163c0 which does not point to an object of type 'BaseSetting'
0x7f21088163c0: note: object has invalid vptr
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              invalid vptr
src/libexpr/primops.cc:2468:36: runtime error: variable length array bound evaluates to non-positive value 0
src/libexpr/primops.cc:2797:35: runtime error: variable length array bound evaluates to non-positive value 0
src/libexpr/primops.cc:3174:24: runtime error: variable length array bound evaluates to non-positive value 0

Steps To Reproduce

  1. Rebuild with listed flags (main thing is -fsanitize=undefined).
  2. Start a build with nix-build or nix build (shouldn't matter).
  3. Observe listed errors.

Expected behavior

I expect that nix doesn't rely on undefined behavior to work correctly.

nix-env --version output

src/libexpr/eval.cc:2579:23: runtime error: member call on address 0x7f6b8cc16340 which does not point to an object of type 'BaseSetting'
0x7f6b8cc16340: note: object has invalid vptr
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              invalid vptr
src/libexpr/eval.cc:2579:53: runtime error: member call on address 0x7f6b8cc163c0 which does not point to an object of type 'BaseSetting'
0x7f6b8cc163c0: note: object has invalid vptr
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              invalid vptr
nix-env (Nix) 2.11.0

Additional context

As far as I know, VLAs may not be length zero, that's why UBSAN is complaining about it. I think the other issue about the member call is due to object initialization order.

It seems to me that the VLA issues could be relatively easily resolved (however, I am not 100% sure how to resolve that without resorting to malloc, which I assume is not preferred due to performance), I am not so sure about the issue in eval.cc.

@Mindavi Mindavi added the bug label Nov 14, 2022
thufschmitt added a commit to thufschmitt/nix that referenced this issue Nov 17, 2022
thufschmitt added a commit to tweag/nix that referenced this issue Nov 17, 2022
Partial fix for NixOS#7302

Some of the primops take a list as one of their argument, and internally create an array of the same length as the list.
This is UB when the size is zero. It just happen to work because the behavior of the primop is trivial in that case and we never touch that array.

Fix this by special-casing the emtpy list case and bailing out early when it happens.
thufschmitt added a commit to tweag/nix that referenced this issue Nov 17, 2022
Partial fix for NixOS#7302

Some primops take a list as one of their argument, and internally create an array of the same length as the list.
This is UB when the size is zero. It just happens to work because the behavior of the primop is trivial in that case, and we never touch that array.

Fix this by special-casing the emtpy list case and bailing out early when it happens.
@stale stale bot added the stale label May 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant