[{"id":3684902,"web_url":"http://patchwork.ozlabs.org/comment/3684902/","msgid":"<809d7bc4-357a-42fd-96fc-3dedd992a396@linaro.org>","list_archive_url":null,"date":"2026-04-30T18:51:18","subject":"Re: [PATCH 2/2] wcsmbs: Add gconv module ref counter overflow test","submitter":{"id":66065,"url":"http://patchwork.ozlabs.org/api/people/66065/","name":"Adhemerval Zanella Netto","email":"adhemerval.zanella@linaro.org"},"content":"On 29/04/26 11:59, Frédéric Bérat wrote:\n> Adds a new xtest, tst-wcsmbs-clone-overflow, to detect reference count\n> leaks in gconv modules.\n> \n> The test specifically targets an issue where functions like swscanf\n> trigger __wcsmbs_clone_conv without a corresponding release when\n> processing wide character strings from stack-allocated buffers. This\n> results in a leaked reference count for the gconv module.\n> \n> The test performs 0x80000000 iterations to ensure a 32-bit signed\n> integer reference counter overflows, thus reliably reproducing and\n> verifying the leak. It is marked as an xtest due to its long runtime.\n> \n> Assisted-by: LLM\n\nI usually see xtests are not that useful, they are not actively tested \nand usually require some specific configuration to run (like some kernel\nsupport).  And requiring 3-5 minutes on a recent chip does not really\nhelp the test-suite, which requires a lot of time already.\n\nMaybe you can make it an unit test / internal test that calls \n__vfwscanf_internal / _IO_wstrfile_fclose_stack and checks the counter\nvalue directly.\n\n> ---\n>  wcsmbs/Makefile                    |  3 +-\n>  wcsmbs/tst-wcsmbs-clone-overflow.c | 50 ++++++++++++++++++++++++++++++\n>  2 files changed, 52 insertions(+), 1 deletion(-)\n>  create mode 100644 wcsmbs/tst-wcsmbs-clone-overflow.c\n> \n> diff --git a/wcsmbs/Makefile b/wcsmbs/Makefile\n> index 849a47971e..e9db577220 100644\n> --- a/wcsmbs/Makefile\n> +++ b/wcsmbs/Makefile\n> @@ -208,7 +208,7 @@ tests := \\\n>    # tests\n>  \n>  # This test runs for a long time.\n> -xtests += test-wcsncmp-nonarray\n> +xtests += test-wcsncmp-nonarray tst-wcsmbs-clone-overflow\n\nIt should be\n\nxtests += \\\n  test-wcsncmp-nonarray \\\n  tst-wcsmbs-clone-overflow \\\n  # xtest\n\n>  \n>  \n>  include ../Rules\n> @@ -241,6 +241,7 @@ $(objpfx)tst-c32-state.out: $(gen-locales)\n>  $(objpfx)test-c8rtomb.out: $(gen-locales)\n>  $(objpfx)test-mbrtoc8.out: $(gen-locales)\n>  $(objpfx)tst-wscanf-to_inpunct.out: $(gen-locales)\n> +$(objpfx)tst-wcsmbs-clone-overflow.out: $(gen-locales)\n>  endif\n>  \n>  $(objpfx)tst-wcstod-round: $(libm)\n> diff --git a/wcsmbs/tst-wcsmbs-clone-overflow.c b/wcsmbs/tst-wcsmbs-clone-overflow.c\n> new file mode 100644\n> index 0000000000..a6f0a25685\n> --- /dev/null\n> +++ b/wcsmbs/tst-wcsmbs-clone-overflow.c\n> @@ -0,0 +1,50 @@\n> +/* Test for gconv module reference counter overflow.\n> +   Copyright (C) 2026 Free Software Foundation, Inc.\n> +   This file is part of the GNU C Library.\n> +\n> +   The GNU C Library is free software; you can redistribute it and/or\n> +   modify it under the terms of the GNU Lesser General Public\n> +   License as published by the Free Software Foundation; either\n> +   version 2.1 of the License, or (at your option) any later version.\n> +\n> +   The GNU C Library is distributed in the hope that it will be useful,\n> +   but WITHOUT ANY WARRANTY; without even the implied warranty of\n> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU\n> +   Lesser General Public License for more details.\n> +\n> +   You should have received a copy of the GNU Lesser General Public\n> +   License along with the GNU C Library; if not, see\n> +   <https://www.gnu.org/licenses/>.  */\n> +\n> +#include <stdio.h>\n> +#include <wchar.h>\n> +#include <locale.h>\n> +#include <support/check.h>\n> +#include <support/support.h>\n> +\n> +static int\n> +do_test (int argc, char **argv)\n> +{\n> +  if (setlocale (LC_ALL, \"de_DE.ISO-8859-1\") == NULL)\n> +    FAIL_EXIT1 (\"setlocale failed, check if de_DE.ISO-8859-1 is generated\");\n> +\n> +  /* The reproduction loop. 0x80000000 iterations are required to overflow\n> +     a 32-bit signed integer. This typically takes 3-5 minutes.  */\n> +  wchar_t buf[32] = L\"123\";\n> +  int j;\n> +  for (long long i = 0; i < 0x80000000LL; i++)\n> +    {\n> +      /* swscanf on a stack-allocated buffer triggers __wcsmbs_clone_conv\n> +         without a corresponding release, leaking a reference count.  */\n> +      if (swscanf (buf, L\"%d\", &j) < 1)\n> +        FAIL_EXIT1 (\"swscanf failed at iteration %lld\", i);\n> +      /* Prevent compiler from optimizing the loop away. */\n> +      __asm__ volatile (\"\" : : \"g\" (j) : \"memory\");\n> +    }\n> +\n> +  return 0;\n> +}\n> +\n> +/* This test is slow because it requires billions of iterations.  */\n> +#define TIMEOUT 600\n> +#include \"../test-skeleton.c\"\n\n#include <support/test-driver.c>","headers":{"Return-Path":"<libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org>","X-Original-To":["incoming@patchwork.ozlabs.org","libc-alpha@sourceware.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","libc-alpha@sourceware.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256\n header.s=google header.b=T76vF9P/;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org\n (client-ip=38.145.34.32; helo=vm01.sourceware.org;\n envelope-from=libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org;\n receiver=patchwork.ozlabs.org)","sourceware.org;\n\tdkim=pass (2048-bit key,\n unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256\n header.s=google header.b=T76vF9P/","sourceware.org;\n dmarc=pass (p=none dis=none) header.from=linaro.org","sourceware.org; spf=pass smtp.mailfrom=linaro.org","server2.sourceware.org;\n arc=none smtp.remote-ip=2607:f8b0:4864:20::1230"],"Received":["from vm01.sourceware.org (vm01.sourceware.org [38.145.34.32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g63Dg59LGz1yHZ\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 01 May 2026 04:51:47 +1000 (AEST)","from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id AC6294310D60\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 30 Apr 2026 18:51:45 +0000 (GMT)","from mail-dl1-x1230.google.com (mail-dl1-x1230.google.com\n [IPv6:2607:f8b0:4864:20::1230])\n by sourceware.org (Postfix) with ESMTPS id 578A24BA9000\n for <libc-alpha@sourceware.org>; Thu, 30 Apr 2026 18:51:24 +0000 (GMT)","by mail-dl1-x1230.google.com with SMTP id\n a92af1059eb24-12c565dd3a7so650610c88.1\n for <libc-alpha@sourceware.org>; Thu, 30 Apr 2026 11:51:24 -0700 (PDT)","from ?IPV6:2804:1b3:a7c0:44cb:1515:6c52:b4a9:e795?\n ([2804:1b3:a7c0:44cb:1515:6c52:b4a9:e795])\n by smtp.gmail.com with ESMTPSA id\n a92af1059eb24-12de3261596sm8724066c88.11.2026.04.30.11.51.20\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Thu, 30 Apr 2026 11:51:21 -0700 (PDT)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 sourceware.org AC6294310D60","OpenDKIM Filter v2.11.0 sourceware.org 578A24BA9000"],"DMARC-Filter":"OpenDMARC Filter v1.4.2 sourceware.org 578A24BA9000","ARC-Filter":"OpenARC Filter v1.0.0 sourceware.org 578A24BA9000","ARC-Seal":"i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1777575084; cv=none;\n b=CJfeVgYLdsC4lldArveQ1mdoQzrwScttmQIzVEFFiy/4Ya39ZtFpPY0p0CNnPi6AAaeNiCwrdZBSrLk4TYntU8U6zsO05wsyt9NS6zfet9+9FJCixV4SQu5mGHx14jjZKvtAh1T8Pvw84MXcB+GiiDTzSi5NMieLT28piY35XuI=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1777575084; c=relaxed/simple;\n bh=DfG3i+G8k/3pJxPcSpaRmktJuGW5a49SGPDqeQj+GcU=;\n h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From;\n b=GCtGtGRpcxFo9jxi4LVPsfYNA8BlOzs737bFxQN4ztDEXLlCqYORHFQ0iqbvqn0KxgcpYhSzBMmYThsYIgtLbj1Hv+6vO0ZkVCX7fc1UlRLbs2/ZDYY90kIRk2QIEG8nU0g0nLEvnEnCtYpYB3j3gmSpYTIAmbRDjPxCQB9/DfM=","ARC-Authentication-Results":"i=1; server2.sourceware.org","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=linaro.org; s=google; t=1777575083; x=1778179883; darn=sourceware.org;\n h=content-transfer-encoding:in-reply-to:organization:from\n :content-language:references:to:subject:user-agent:mime-version:date\n :message-id:from:to:cc:subject:date:message-id:reply-to;\n bh=wiywyJfJlFb5wE5+W5cn2aIfcxBGvrvBDmkOFM4xtWs=;\n b=T76vF9P/2QbYLsZNTlrB9EM8aHQYFkpJYGaFROtbnU01B96Ih7k3wsM8F7GbrmR/jx\n KxkusfX1dyyNZ/M4fNjMO3o6Es9rivzzwcTDqtB9wUjHmMBB8nGqDlO50POmzpaMEWz1\n F3fjIlnpLtxFUnZnDUYe2Ip7Nnd5kOfietWH+Nt5EIaD6WuFTdpOcMAU6/poM0RpibjT\n B5p44G7wQ3O3BL9yXya3eTLy6pBDzDYm8rNkl+S/UTjJHDBrauIc5ARzkkZp1Tjtoqyp\n kPwQKgzUBp9xIeECieQlq/Qe2K8gQhLLjarAG2P4ztlzSKpgTJ+lfIW2onhIzRgP8bat\n tQBQ==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777575083; x=1778179883;\n h=content-transfer-encoding:in-reply-to:organization:from\n :content-language:references:to:subject:user-agent:mime-version:date\n :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=wiywyJfJlFb5wE5+W5cn2aIfcxBGvrvBDmkOFM4xtWs=;\n b=dGRaRRO/Nt77ci5onxgtyL5S0yIItMtBbxsT9aWmXMs1q9Jj3p9CWE31UBx33PteXh\n oosO+RkSzs+fEkCsYj8uQCFDlZPxnMrq4+lxNoe5EJdj06xjb88AyUMh+zMX4AiQbFS+\n E7ofbhWEmitzxTUhMF9TKVkz+rH0EJNzvTeGBWGEap4WHXMI+B65gxKKjWfBzYOrV4Zt\n SdrPTCe2I57919VjZVAUZcCSfpZInCrkiO+zNQzR+3e2LPHGaM19JMYFyBqbhiBBZrV9\n eNhfeutpXcKvhPJkOYnvwIQXtSygZoHP+lNbp8D8ArqUk/RRNJWX8SSgVUcTf2qsmzZw\n RwHA==","X-Forwarded-Encrypted":"i=1;\n AFNElJ+7jRgSJNqFa0P5QA+CK5UHFpxuidxt+yGBFV0uSflYFrH+s9gV43QJYi/REU74cho2yvzoQseuseTd@sourceware.org","X-Gm-Message-State":"AOJu0YzV1NYwRkBQkb/1qUZnZu+gHT959kb3rnHEt6AqxI1FeVhOhMbM\n v3UHraap+1aDskj71SbkGg0X6Fmu3VcP0Ta4q8TKyppZL43eOBS+GgwbKnhPikntCoM=","X-Gm-Gg":"AeBDiev530pfGy+PJ3TwuX6hnwBSw5TBrSemMdbui1CC9YzxeCNk5WY8zk2bf6Z8tJN\n 5/HueLP5xZZ+4QeNkQuK0ghWfTg2I20cpcn2Jaw94E4JSz4fjgZ0yHcEoUk8mkXYynDM++JLDJU\n fFO6t+BQygGBnrf1xwmODQZLFMZ/XzBoFzFX2rarDbKiNlJ4JJ2emosukKJHTQWbdRtYef77X39\n VXKAOCjKd94UVD5EUEWuy00be5Ix40D0FFqjK3YISL/5jVbA6tbxP7fCUEofSeLpVtFKuabuZn8\n iX/ZoUKKcTqMYbfGOgxx20/G5x+XOR6vyKpBrMMHi6c4QlNjtRpOyhTmg2vU2aon0Y9fygCiZ3O\n eGhERxs4QvFS5zQlm7H65AcC/yasmvIztm2JNrEIsKIngn23gJpz8f5k2ET9Bn6MKo2bB7DheSF\n GS6Fx6EwiJrGQmHsOCrn1d3GBzzL9DlazyjLcZFXG9A3wBd8r2PHVq+dvHNJXRv89lxwNyvTuC3\n G28Jd0hyUWdj+PelYMMWrz3jz+M2iivUWZFjRdoyZe5lX5CGsis7rQ=","X-Received":"by 2002:a05:7022:423:b0:12a:713b:8964 with SMTP id\n a92af1059eb24-12deac3ff33mr2189678c88.11.1777575083109;\n Thu, 30 Apr 2026 11:51:23 -0700 (PDT)","Message-ID":"<809d7bc4-357a-42fd-96fc-3dedd992a396@linaro.org>","Date":"Thu, 30 Apr 2026 15:51:18 -0300","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH 2/2] wcsmbs: Add gconv module ref counter overflow test","To":"=?utf-8?b?RnLDqWTDqXJpYyBCw6lyYXQ=?= <fberat@redhat.com>,\n libc-alpha@sourceware.org, dj@redhat.com, fweimer@redhat.com","References":"<20260429145934.278803-1-fberat@redhat.com>\n <20260429145934.278803-3-fberat@redhat.com>","Content-Language":"en-US","From":"Adhemerval Zanella Netto <adhemerval.zanella@linaro.org>","Organization":"Linaro","In-Reply-To":"<20260429145934.278803-3-fberat@redhat.com>","Content-Type":"text/plain; charset=UTF-8","Content-Transfer-Encoding":"8bit","X-BeenThere":"libc-alpha@sourceware.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Libc-alpha mailing list <libc-alpha.sourceware.org>","List-Unsubscribe":"<https://sourceware.org/mailman/options/libc-alpha>,\n <mailto:libc-alpha-request@sourceware.org?subject=unsubscribe>","List-Archive":"<https://sourceware.org/pipermail/libc-alpha/>","List-Post":"<mailto:libc-alpha@sourceware.org>","List-Help":"<mailto:libc-alpha-request@sourceware.org?subject=help>","List-Subscribe":"<https://sourceware.org/mailman/listinfo/libc-alpha>,\n <mailto:libc-alpha-request@sourceware.org?subject=subscribe>","Errors-To":"libc-alpha-bounces~incoming=patchwork.ozlabs.org@sourceware.org"}}]