Avoid signed overflow in DBG_FlushInstructionCache #105918
Conversation
On ARM32 Linux we can have an infinite loop because of integer overflow. For example, if DBG_FlushInstructionCache is called with the following parameters & locals: dwSize = 28 pageSize = 4096 begin = lpBaseAddress = 0x7ffff000 end = begin + dwSize = 0x7ffff01c ALIGN_UP(0x7ffff000, 4096) returns 0x80000000 which is actually a negative number because INT_PTR is just int32_t (on ARM32). And here we are getting an infinite loop because "begin" will never be greater or equal than "end". So, this issue is related to all addresses between INT32_MAX - PAGE_SIZE and INT32_MAX because ALIGN_UP returns the address of the next page which will be greater or equal to INT32_MAX Signed-off-by: Andrei Lalaev <andrei.lalaev@anton-paar.com>
dotnet-policy-service
bot
added
the
community-contribution
|
Are there any plans to release this for .NET 6 on ARM32 anytime soon? |
|
.NET 6 is near end of life. You will need to upgrade soon to stay on a supported version. We can consider backporting this fix to .NET 8 & 9 if the bug impacts real world applications. Do you hit this bug in your applications? |
|
Yes we're affected in a way that our embedded applications hangs during startup every 10-20th time due to this bug (patch was actually provided by us). We know that we should switch to .NET 8 or later, however, we can't due to another bug: #102396 So it would be really helpful if you could backport this fix to .NET 6, too. |
|
/backport to release/9.0 |
|
Started backporting to release/9.0: https://github.com/dotnet/runtime/actions/runs/10512533851 |
I am sorry. This is not a security fix. Our policy is to only backport security fixed during the last 6 months of the release lifetime: https://dotnet.microsoft.com/en-us/platform/support/policy/dotnet-core .
Could you please try .NET 9 Preview 7 to see whether the crash still repros? If it still repros on .NET 9, it would be useful to get more details about the crash - unmanaged stacktraces, disassembly of the code around the place where it crashed, etc. |
Prepared a setup with Toradex Apalis imx6q with Yocto scarthgap and .NET9 Preview 7: Issue still exists and application crashes.
We'll do so in #102396 |
On ARM32 Linux we can have an infinite loop because of integer overflow.
For example, if
DBG_FlushInstructionCacheis called with the following parameters & locals:ALIGN_UP(0x7ffff000, 4096)returns 0x80000000 which is actually a negative number becauseINT_PTRis justint32_t(on ARM32). And here we are getting an infinite loop becausebeginwill never be greater or equal thanend.Fix the issue by using
UINT_PTRinstead ofINT_PTR.