Fix UB due to misaligned RawDir pointer (#464)

* Fix UB due to misaligned RawDir pointer

Signed-off-by: Alex Saveau <[email protected]>

* Add alignment and stack tests to RawDir

Signed-off-by: Alex Saveau <[email protected]>

Signed-off-by: Alex Saveau <[email protected]>

Author: SUPERCILEX

src/fs/raw_dir.rs

@@ -1,7 +1,7 @@
 //! `RawDir` and `RawDirEntry`.
 
 use core::fmt;
-use core::mem::MaybeUninit;
+use core::mem::{align_of, MaybeUninit};
 use linux_raw_sys::general::linux_dirent64;
 
 use crate::backend::fs::syscalls::getdents_uninit;
@@ -26,6 +26,8 @@ pub struct RawDir<'buf, Fd: AsFd> {
 impl<'buf, Fd: AsFd> RawDir<'buf, Fd> {
     /// Create a new iterator from the given file descriptor and buffer.
     ///
+    /// Note: the buffer size may be trimmed to accommodate alignment requirements.
+    ///
     /// # Examples
     ///
     /// ## Simple but non-portable
@@ -95,7 +97,14 @@ impl<'buf, Fd: AsFd> RawDir<'buf, Fd> {
     pub fn new(fd: Fd, buf: &'buf mut [MaybeUninit<u8>]) -> Self {
         Self {
             fd,
-            buf,
+            buf: {
+                let offset = buf.as_ptr().align_offset(align_of::<linux_dirent64>());
+                if offset < buf.len() {
+                    &mut buf[offset..]
+                } else {
+                    &mut []
+                }
+            },
             initialized: 0,
             offset: 0,
         }
@@ -162,7 +171,8 @@ impl<'buf, Fd: AsFd> Iterator for RawDir<'buf, Fd> {
                 // SAFETY:
                 // - This data is initialized by the check above.
                 //   - Assumption: the kernel will not give us partial structs.
-                // - Assumption: the kernel uses proper alignment.
+                // - Assumption: the kernel uses proper alignment between structs.
+                // - The starting pointer is aligned (performed in RawDir::new)
                 let dirent = unsafe { &*dirent_ptr.cast::<linux_dirent64>() };
 
                 self.offset += usize::from(dirent.d_reclen);

tests/fs/readdir.rs

@@ -2,6 +2,7 @@
 
 use std::collections::HashMap;
 use std::fs::File;
+use std::mem::MaybeUninit;
 
 use rustix::fs::{Dir, DirEntry};
 
@@ -52,9 +53,8 @@ fn read_entries(dir: &mut Dir) -> HashMap<String, DirEntry> {
     out
 }
 
-#[test]
 #[cfg(any(target_os = "android", target_os = "linux"))]
-fn raw_dir_entries() {
+fn test_raw_dir(buf: &mut [MaybeUninit<u8>]) {
     use std::io::{Seek, SeekFrom};
 
     use rustix::fd::AsFd;
@@ -80,8 +80,7 @@ fn raw_dir_entries() {
 
     let tmpdir = tempfile::tempdir().expect("construct tempdir");
     let mut dirfd = File::open(tmpdir.path()).expect("open tempdir as file");
-    let mut buf = Vec::with_capacity(8192);
-    let mut dir = RawDir::new(dirfd.try_clone().unwrap(), buf.spare_capacity_mut());
+    let mut dir = RawDir::new(dirfd.try_clone().unwrap(), buf);
 
     let entries = read_raw_entries(&mut dir);
     assert_eq!(entries.len(), 0, "no files in directory");
@@ -113,6 +112,31 @@ fn raw_dir_entries() {
     assert_eq!(entries.len(), 2);
 }
 
+#[test]
+#[cfg(any(target_os = "android", target_os = "linux"))]
+fn raw_dir_entries_heap() {
+    let mut buf = Vec::with_capacity(8192);
+    test_raw_dir(buf.spare_capacity_mut());
+}
+
+#[test]
+#[cfg(any(target_os = "android", target_os = "linux"))]
+fn raw_dir_entries_stack() {
+    let mut buf = [MaybeUninit::uninit(); 2048];
+    test_raw_dir(&mut buf);
+}
+
+#[test]
+#[cfg(any(target_os = "android", target_os = "linux"))]
+fn raw_dir_entries_unaligned() {
+    let mut buf = [MaybeUninit::uninit(); 2048];
+    let buf = &mut buf[1..];
+
+    assert!(!(buf.as_ptr() as usize).is_power_of_two());
+
+    test_raw_dir(buf);
+}
+
 #[test]
 fn dir_from_openat() {
     let dirfd = rustix::fs::openat(