Skip to content

cast to unsigned char before toupper in cache size parser#420

Open
soma0212 wants to merge 1 commit into
pytorch:mainfrom
soma0212:cache-size-ctype-cast
Open

cast to unsigned char before toupper in cache size parser#420
soma0212 wants to merge 1 commit into
pytorch:mainfrom
soma0212:cache-size-ctype-cast

Conversation

@soma0212

Copy link
Copy Markdown

toupper() in cache_size_parser gets a plain char, which is signed on the ARM/Android targets this file builds for:

  • the argument is the first non-digit byte of the sysfs cache-size value (/sys/.../cache/indexN/size), so any byte >= 0x80 reaches toupper as a negative int
  • C11 7.4p1 requires the argument to be representable as unsigned char or equal to EOF; bionic and musl index their ctype table directly with it, so a negative value is an out-of-bounds read
  • cast to unsigned char, the standard guard for ctype on possibly-signed input

@meta-cla

meta-cla Bot commented Jul 15, 2026

Copy link
Copy Markdown

Hi @soma0212!

Thank you for your pull request and welcome to our community.

Action Required

In order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you.

Process

In order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA.

Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with CLA signed. The tagging process may take up to 1 hour after signing. Please give it that time before contacting us about it.

If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks!

@fbarchard fbarchard left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

makes sense. its good there is a comment above showing (e.g. "2048K", "1M")
for context. Makes me think the default
uint32_t multiplier = 1024;
should really be '1' and check for 'K' the same way.

or just expect it to be upper case. when I check my linux workstation it says
more /sys/devices/system/cpu/cpu0/cache/index0/size
32K
pixel2 android device is
adb shell more /sys/devices/system/cpu/cpu0/cache/index0/size
32K

@soma0212

Copy link
Copy Markdown
Author

Right, the generic cacheinfo driver formats this value as "%uK" (size_show in drivers/base/cacheinfo.c), so on mainline kernels the suffix is always present and always uppercase, which lines up with what you're seeing on both your boxes. That means the KB default and the toupper only matter for vendor kernels that stray from that, and treating a bare number as KB has been this parser's behavior all along. I kept this PR to just the cast so it fixes the UB without changing behavior on any input, but happy to switch to multiplier = 1 with an explicit 'K' check in a follow-up if you'd prefer that shape.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants