Messages in this thread | | | From | Johannes Weiner <> | Subject | Re: Dangerous code in cpumask_of_cpu? | Date | Tue, 08 Jul 2008 11:28:32 +0200 |
| |
[ fixed christoph's address in cc]
Johannes Weiner <hannes@saeurebad.de> writes:
>> I guess because we dereference it immediately again, the location is not >> clobbered yet. At least in my test case, gcc assembled it to code that >> puts the address in eax and derefences it immediately, before eax is >> reused: > > Gee, just ignore this bs. The address is in eax, not the value.
My theory was half-right. Since the code is a macro, there is no call and hence no stack clean-up. And although it is UB, it works correctly as the value is not yet clobbered when we access it again. Converting foo to a macro yields this:
movl $42, -8(%ebp) leal -8(%ebp), %eax movl (%eax), %eax ... ret
gcc only emits a warning if the scope we leak a local address from is that of a function.
Hannes
| |