commit d73fa085a62a68df5b6b9ee90146a33bd06c4824
author Erik Gilling <konkers@google.com> Thu Feb 06 11:43:15 2025 -0800
committer CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> Thu Feb 06 11:43:15 2025 -0800
tree 1fd05185813ee0bf349970c76a762d52816a0511
parent 1adef87a3192c792147a0d2ff430b955384e6430

list: Fix pointer math bug

Change-Id: Ic176d7401d99aa143edf41fe3ca65412ef42ec19
Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/maize/+/265654
Pigweed-Auto-Submit: Erik Gilling <konkers@google.com>
Presubmit-Verified: CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Travis Geiselbrecht <travisg@google.com>
Commit-Queue: Auto-Submit <auto-submit@pigweed-service-accounts.iam.gserviceaccount.com>
Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com>

lib/list/list.rs

diff --git a/lib/list/list.rs b/lib/list/list.rs
index 93578d5..f09f9f0 100644
--- a/lib/list/list.rs
+++ b/lib/list/list.rs
@@ -163,15 +163,15 @@
 
     unsafe fn get_link_ptr(element: &T) -> NonNull<Link> {
         let element_ptr: NonNull<Link> = core::mem::transmute::<&T, NonNull<Link>>(element);
-        element_ptr.byte_sub(A::LINK_OFFSET)
+        element_ptr.byte_add(A::LINK_OFFSET)
     }
 
     unsafe fn get_element_ptr(link: NonNull<Link>) -> *const T {
-        link.byte_add(A::LINK_OFFSET).as_ptr() as *const T
+        link.byte_sub(A::LINK_OFFSET).as_ptr() as *const T
     }
 
     unsafe fn get_element_mut(link: NonNull<Link>) -> *mut T {
-        link.byte_add(A::LINK_OFFSET).as_ptr() as *mut T
+        link.byte_sub(A::LINK_OFFSET).as_ptr() as *mut T
     }
 
     /// unchecked means we don't `assert!((*element_ptr.as_ptr()).is_unlinked());`

lib/list/tests/list_test.rs

diff --git a/lib/list/tests/list_test.rs b/lib/list/tests/list_test.rs
index 676d6aa..2649d36 100644
--- a/lib/list/tests/list_test.rs
+++ b/lib/list/tests/list_test.rs
@@ -19,6 +19,11 @@
 use list::*;
 use unittest::test;
 
+// `#[repr(C)]` is used to ensure that `link` is at a non-zero offset.
+// Previously, without this, the compiler was putting link at the beginning of
+// the struct causing `LINK_OFFSET` in the adapter to be zero which obfuscated
+// some pointer math bugs.
+#[repr(C)]
 struct TestMember {
     value: u32,
     link: Link,