Skip to content

nexus: fix GroupId::operator!= typo and UAF in pack_iodelay - #1661

Closed
taskx6004 wants to merge 1 commit into
YosysHQ:mainfrom
taskx6004:fix/nexus-bugs
Closed

nexus: fix GroupId::operator!= typo and UAF in pack_iodelay#1661
taskx6004 wants to merge 1 commit into
YosysHQ:mainfrom
taskx6004:fix/nexus-bugs

Conversation

@taskx6004

Copy link
Copy Markdown

Summary

  • archdefs.h: GroupId::operator!= uses y == other.y instead of y != other.y in the last term, making the operator always return true when only y differs. This is a copy-paste error from operator==.
  • pack.cc: base_iodelay_rules[id_DELAYA] = base_iodelay_rules[id_DELAYB] is undefined behavior — operator[] on the LHS may rehash the dict, invalidating the reference returned by operator[] on the RHS. Fixed by copying the value to a local before inserting.

Both bugs were found while working on LIFCL-33U bringup but are device-independent.

Test plan

  • Verify nexus builds with no warnings
  • Run existing nexus test designs

🤖 Generated with Claude Code

archdefs.h: GroupId::operator!= had `y == other.y` instead of
`y != other.y`, making inequality checks on groups incorrect.

pack.cc: In pack_iodelay(), the line
`base_iodelay_rules[id_DELAYA] = base_iodelay_rules[id_DELAYB]`
causes use-after-free when the dict rehashes during insert — the
reference to `base_iodelay_rules[id_DELAYB]` on the RHS becomes
dangling when `operator[]` on the LHS triggers a rehash. Fixed by
copying the value before inserting.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@gatecat

gatecat commented Mar 8, 2026

Copy link
Copy Markdown
Member

I think these are reasonable changes but I'd need to check the rehashing part (also no need for the std::move in the usual nextpnr style for non-perf-critical sections).

However after the amount of upset it caused last time I'd prefer it if you resubmitted this without Claude.

As for the various LIFCL-33U PRs, this work is currently ongoing in gatecat/prjoxide#49 along with bigger prjoxide changes and more extensive testing/change handling so I won't be merging that.

@taskx6004

taskx6004 commented Mar 8, 2026 via email

Copy link
Copy Markdown
Author

@gatecat gatecat closed this Mar 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants