posix: Fix -Warray-bounds instances building timer_create [BZ #26687]

GCC 11 -Warray-bounds triggers invalid warnings when building
Linux timer_create.c:

../sysdeps/unix/sysv/linux/timer_create.c: In function '__timer_create_new':
../sysdeps/unix/sysv/linux/timer_create.c:83:17: warning: array subscript 'struct timer[0]' is partly outside array bounds of 'unsigned char[8]' [-Warray-bounds]
   83 |             newp->sigev_notify = (evp != NULL
      |                 ^~
../sysdeps/unix/sysv/linux/timer_create.c:59:47: note: referencing an object of size 8 allocated by 'malloc'
   59 |         struct timer *newp = (struct timer *) malloc (offsetof (struct timer,
      |                                               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   60 |                                                                 thrfunc));
      |                                                                 ~~~~~~~~~

The struct allocated for !SIGEV_THREAD timers only requires two 'int'
fields (sigev_notify and ktimerid) and the offsetof trick tries minimize
the memory usage by only allocation the required size.  However,
although the resulting size is suffice for !SIGEV_THREAD time, accessing
the partially allocated object is error-prone and UB.

This patch fixes both issues by embedding the information whether
the timer if a SIGEV_THREAD in the returned 'timer_t'.  For
!SIGEV_THREAD, the resulting 'timer_t' is the returned kernel timer
identifer (kernel_timer_t), while for SIGEV_THREAD it uses the fact
malloc returns at least _Alignof (max_align_t) pointers plus that
valid kernel_timer_t are always positive to set MSB bit of the returned
'timer_t' to indicate the timer handles a SIGEV_THREAD.

It allows to remove the memory allocation for !SIGEV_THREAD and also
remove the 'sigev_notify' field from 'struct timer'.

Checked on x86_64-linux-gnu and i686-linux-gnu.

1 files changed, 4 insertions, 4 deletions

diff --git a/sysdeps/unix/sysv/linux/timer_settime.c b/sysdeps/unix/sysv/linux/timer_settime.c
index c97a9e92ef..01c6257938 100644
--- a/sysdeps/unix/sysv/linux/timer_settime.c
+++ b/sysdeps/unix/sysv/linux/timer_settime.c
@@ -28,17 +28,17 @@ __timer_settime64 (timer_t timerid, int flags,
                    const struct __itimerspec64 *value,
                    struct __itimerspec64 *ovalue)
 {
-  struct timer *kt = (struct timer *) timerid;
+  kernel_timer_t ktimerid = timerid_to_kernel_timer (timerid);
 
 #ifdef __ASSUME_TIME64_SYSCALLS
 # ifndef __NR_timer_settime64
 #  define __NR_timer_settime64 __NR_timer_settime
 # endif
-  return INLINE_SYSCALL_CALL (timer_settime64, kt->ktimerid, flags, value,
+  return INLINE_SYSCALL_CALL (timer_settime64, ktimerid, flags, value,
                               ovalue);
 #else
 # ifdef __NR_timer_settime64
-  int ret = INLINE_SYSCALL_CALL (timer_settime64, kt->ktimerid, flags, value,
+  int ret = INLINE_SYSCALL_CALL (timer_settime64, ktimerid, flags, value,
                                  ovalue);
   if (ret == 0 || errno != ENOSYS)
     return ret;
@@ -55,7 +55,7 @@ __timer_settime64 (timer_t timerid, int flags,
   its32.it_interval = valid_timespec64_to_timespec (value->it_interval);
   its32.it_value = valid_timespec64_to_timespec (value->it_value);
 
-  int retval = INLINE_SYSCALL_CALL (timer_settime, kt->ktimerid, flags,
+  int retval = INLINE_SYSCALL_CALL (timer_settime, ktimerid, flags,
                                     &its32, ovalue ? &oits32 : NULL);
   if (retval == 0 && ovalue)
     {