[PATCH] riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts

[PATCH] riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

commit 5d588c684833 ("riscv: lib: Fix ZBB strnlen reading past count
boundary") computes the aligned scan boundary from the last valid byte
(s + count - 1).  When count is huge (e.g. SIZE_MAX, which FORTIFY
strcat/strlcat pass when the destination size is not known at compile
time), s + count wraps around and the aligned boundary lands before s.
The pre-loop guard "bgeu t0, t4, 2f" then always exits for aligned
strings of 8 or more characters, and strnlen() returns 8 instead of
the real length.

This silently truncates strings built by fortified strcat: the dm
sysfs name attribute shows "live-bas" instead of "live-base", the
truncated name pollutes the udev database, and blivet/anaconda (as
well as LVM/dm-crypt/multipath userspace) break on RISC-V systems.

Detect the wrap-around and saturate the boundary to the top of the
address space, making the scan equivalent to strlen().  Normal counts
are unaffected.

Fixes: 5d588c684833 ("riscv: lib: Fix ZBB strnlen reading past count boundary")
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
 arch/riscv/lib/strnlen.S | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/riscv/lib/strnlen.S b/arch/riscv/lib/strnlen.S
index a8911605c248..2451289ed0f9 100644
--- a/arch/riscv/lib/strnlen.S
+++ b/arch/riscv/lib/strnlen.S
@@ -87,9 +87,19 @@ strnlen_zbb:
 	 * Aligned boundary.  Use the address of the last valid byte
 	 * (s + count - 1) to avoid loading a word past the count
 	 * boundary in the loop below.  count == 0 is handled above.
+	 *
+	 * Saturate the boundary when s + count wraps around (very large
+	 * counts, e.g. SIZE_MAX passed by FORTIFY strcat/strlcat with a
+	 * destination whose size is unknown at compile time).  Without
+	 * this, the wrapped boundary lands before s and the pre-loop
+	 * guard below always exits, returning a truncated length.
+	 * Saturating makes the scan equivalent to strlen().
 	 */
 	add	t4, a0, a1
 	addi	t4, t4, -1
+	bgeu	t4, a0, 1f
+	li	t4, -1
+1:
 	andi	t4, t4, -SZREG

 	/* Get the first word.  */
-- 
2.27.0

Re: [PATCH] riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts

[shao.mingyin]

Hi Paul,

Friendly ping on this one - just checking whether there are any comments,
or if it needs any changes before it can be picked up.

Quick recap: commit 5d588c684833 ("riscv: lib: Fix ZBB strnlen reading
past count boundary"), released in v7.1.10/7.2, introduced a regression
where strnlen(s, SIZE_MAX) returns 8 for any 8+-byte aligned string:
the wrap-around boundary (s + count - 1) & ~7 folds back to s - 8, so
the pre-loop guard always passes.  This truncates names built through
FORTIFY strcat/strlcat - e.g. device-mapper's sysfs name "live-base"
becomes "live-bas", which broke blivet/anaconda installs on RISC-V.

The fix stays entirely inside the ZBB path - no fallback, just 2 extra
instructions - by saturating the boundary instead of letting it wrap.
Normal counts are unaffected.

Verified with a dedicated test module (all cases pass) and a 6098-case
semantic simulation comparing the original/current/fixed variants
(0 failures, 0 faults).  Happy to rebase onto riscv fixes if preferred.

Thanks,
Shao Mingyin

Re: [PATCH] riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts

[Michael Neuling]

> From: Shao Mingyin <shao.mingyin@zte.com.cn>
>
> commit 5d588c684833 ("riscv: lib: Fix ZBB strnlen reading past count
> boundary") computes the aligned scan boundary from the last valid byte
> (s + count - 1).  When count is huge (e.g. SIZE_MAX, which FORTIFY
> strcat/strlcat pass when the destination size is not known at compile
> time), s + count wraps around and the aligned boundary lands before s.
> The pre-loop guard "bgeu t0, t4, 2f" then always exits for aligned
> strings of 8 or more characters, and strnlen() returns 8 instead of
> the real length.
>
> This silently truncates strings built by fortified strcat: the dm
> sysfs name attribute shows "live-bas" instead of "live-base", the
> truncated name pollutes the udev database, and blivet/anaconda (as
> well as LVM/dm-crypt/multipath userspace) break on RISC-V systems.
>
> Detect the wrap-around and saturate the boundary to the top of the
> address space, making the scan equivalent to strlen().  Normal counts
> are unaffected.

Nice catch

> Fixes: 5d588c684833 ("riscv: lib: Fix ZBB strnlen reading past count boundary")

I believe this issue also affects original strnlen implementation, so
this should actually be:
  Fixes: 5ba15d419fab ("riscv: lib: add strnlen() implementation")
The text in the commit needs to be fixed also.

> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>

Other than the above:
Acked-By: Michael Neuling <mikey@neuling.org>

> ---
>  arch/riscv/lib/strnlen.S | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/arch/riscv/lib/strnlen.S b/arch/riscv/lib/strnlen.S
> index a8911605c248..2451289ed0f9 100644
> --- a/arch/riscv/lib/strnlen.S
> +++ b/arch/riscv/lib/strnlen.S
> @@ -87,9 +87,19 @@ strnlen_zbb:
>          * Aligned boundary.  Use the address of the last valid byte
>          * (s + count - 1) to avoid loading a word past the count
>          * boundary in the loop below.  count == 0 is handled above.
> +        *
> +        * Saturate the boundary when s + count wraps around (very large
> +        * counts, e.g. SIZE_MAX passed by FORTIFY strcat/strlcat with a
> +        * destination whose size is unknown at compile time).  Without
> +        * this, the wrapped boundary lands before s and the pre-loop
> +        * guard below always exits, returning a truncated length.
> +        * Saturating makes the scan equivalent to strlen().
>          */
>         add     t4, a0, a1
>         addi    t4, t4, -1
> +       bgeu    t4, a0, 1f
> +       li      t4, -1
> +1:
>         andi    t4, t4, -SZREG
>
>         /* Get the first word.  */
> --
> 2.27.0
>
> _______________________________________________
> linux-riscv mailing list
> linux-riscv@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH] riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts

[David Laight]

On Fri, 28 Aug 2026 14:51:52 +0800 (CST)
<shao.mingyin@zte.com.cn> wrote:

> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> commit 5d588c684833 ("riscv: lib: Fix ZBB strnlen reading past count
> boundary") computes the aligned scan boundary from the last valid byte
> (s + count - 1).  When count is huge (e.g. SIZE_MAX, which FORTIFY
> strcat/strlcat pass when the destination size is not known at compile
> time), s + count wraps around and the aligned boundary lands before s.
> The pre-loop guard "bgeu t0, t4, 2f" then always exits for aligned
> strings of 8 or more characters, and strnlen() returns 8 instead of
> the real length.
> 
> This silently truncates strings built by fortified strcat: the dm
> sysfs name attribute shows "live-bas" instead of "live-base", the
> truncated name pollutes the udev database, and blivet/anaconda (as
> well as LVM/dm-crypt/multipath userspace) break on RISC-V systems.
> 
> Detect the wrap-around and saturate the boundary to the top of the
> address space, making the scan equivalent to strlen().  Normal counts
> are unaffected.
> 
> Fixes: 5d588c684833 ("riscv: lib: Fix ZBB strnlen reading past count boundary")
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
> ---
>  arch/riscv/lib/strnlen.S | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/arch/riscv/lib/strnlen.S b/arch/riscv/lib/strnlen.S
> index a8911605c248..2451289ed0f9 100644
> --- a/arch/riscv/lib/strnlen.S
> +++ b/arch/riscv/lib/strnlen.S
> @@ -87,9 +87,19 @@ strnlen_zbb:
>  	 * Aligned boundary.  Use the address of the last valid byte
>  	 * (s + count - 1) to avoid loading a word past the count
>  	 * boundary in the loop below.  count == 0 is handled above.
> +	 *
> +	 * Saturate the boundary when s + count wraps around (very large
> +	 * counts, e.g. SIZE_MAX passed by FORTIFY strcat/strlcat with a
> +	 * destination whose size is unknown at compile time).  Without
> +	 * this, the wrapped boundary lands before s and the pre-loop
> +	 * guard below always exits, returning a truncated length.
> +	 * Saturating makes the scan equivalent to strlen().
>  	 */
>  	add	t4, a0, a1
>  	addi	t4, t4, -1
> +	bgeu	t4, a0, 1f
> +	li	t4, -1
> +1:

Ugg....
That adds a taken branch to the normal path that is likely to get
mispredicted.
Might be better replaced with a cmp, dec, or sequence.

David 


>  	andi	t4, t4, -SZREG
> 
>  	/* Get the first word.  */