fix undefined behavior in sched.h cpu_set_t usage

since cpu sets can be dynamically allocated and have variable size,
accessing their contents via ->__bits is not valid; performing pointer
arithmetic outside the range of the size of the declared __bits array
results in undefined beahavior. instead, only use cpu_set_t for
fixed-size cpu set objects (instantiated by the caller) and as an
abstract pointer type for dynamically allocated ones. perform all
accesses simply by casting the abstract pointer type cpuset_t * back
to unsigned long *.

diff --git a/include/sched.h b/include/sched.h
index af82d6c9bd27b87d67eada43ef6968760d5b38ef..d1cccb7059da35c60d7db33ed5a834402b18a114 100644 (file)
--- a/include/sched.h
+++ b/include/sched.h
@@ -82,7 +82,7 @@ int sched_getaffinity(pid_t, size_t, cpu_set_t *);
 int sched_setaffinity(pid_t, size_t, const cpu_set_t *);
 
 #define __CPU_op_S(i, size, set, op) ( (i)/8U >= (size) ? 0 : \
-       ((set)->__bits[(i)/8/sizeof(long)] op (1UL<<((i)%(8*sizeof(long))))) )
+       (((unsigned long *)(set))[(i)/8/sizeof(long)] op (1UL<<((i)%(8*sizeof(long))))) )
 
 #define CPU_SET_S(i, size, set) __CPU_op_S(i, size, set, |=)
 #define CPU_CLR_S(i, size, set) __CPU_op_S(i, size, set, &=~)
@@ -94,8 +94,8 @@ static __inline void __CPU_##func##_S(size_t __size, cpu_set_t *__dest, \
 { \
        size_t __i; \
        for (__i=0; __i<__size/sizeof(long); __i++) \
-               __dest->__bits[__i] = __src1->__bits[__i] \
-                       op __src2->__bits[__i] ; \
+               ((unsigned long *)__dest)[__i] = ((unsigned long *)__src1)[__i] \
+                       op ((unsigned long *)__src2)[__i] ; \
 }
 
 __CPU_op_func_S(AND, &)