[ARROW-10914] [Rust]: SIMD implementation of arithmetic kernels reads out of bounds

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0
• Component/s: Rust
• Labels: pull-request-available
• External issue URL: https://github.com/apache/arrow/issues/26844
• Assignee: Jörn Horstmann
• Reporter: Jörn Horstmann
• Created: 15/Dec/20 10:21
• Updated: 11/Jan/23 08:16
• Resolved: 19/Dec/20 08:51

Description

The simd arithmetic kernels use the following pattern repeatedly:

    for i in (0..left.len()).step_by(lanes) { ... }

If len is not a multiple of the number of lanes, this would read out of bounds in the last iteration. Currently, all buffers have an additional padding of 64 bytes (equal to the simd width), which masks this problem in most tests. As soon as we use a slice of an array, it should however be reproducible even with this padding.

Even without a crash, the issue is detectable with valgrind:

==31106== Invalid read of size 32
==31106==    at 0x1ECEE1: arrow::compute::kernels::arithmetic::add::hfded8b2c06cf22de (in /home/joernhorstmann/Source/github/apache/arrow/rust/target/release/deps/arrow-205580f93d58d5a9)
==31106==    by 0x2650EF: arrow::compute::kernels::arithmetic::tests::test_arithmetic_kernel_should_not_rely_on_padding::hacb7c7921dc38e6a (in /home/joernhorstmann/Source/github/apache/arrow/rust/target/release/deps/arrow-205580f93d58d5a9)

Issue Links

• links to: GitHub Pull Request #8929