| Message ID | 20220719140424.430572-2-gwan-gyeong.mun@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation | expand |
On Tue, Jul 19, 2022 at 05:04:18PM +0300, Gwan-gyeong Mun wrote: > It moves overflows_type utility macro into drm util header from i915_utils > header. The overflows_type can be used to catch the truncation between data > types. And it adds safe_conversion() macro which performs a type conversion > (cast) of an source value into a new variable, checking that the > destination is large enough to hold the source value. > And it adds exact_type and exactly_pgoff_t macro to catch type mis-match > while compiling. > > v3: Add is_type_unsigned() macro (Mauro) > Modify overflows_type() macro to consider signed data types (Mauro) > Fix the problem that safe_conversion() macro always returns true > v4: Fix kernel-doc markups > > Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> > Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> > Cc: Matthew Auld <matthew.auld@intel.com> > Cc: Nirmoy Das <nirmoy.das@intel.com> > Cc: Jani Nikula <jani.nikula@intel.com> > Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> > --- > drivers/gpu/drm/i915/i915_utils.h | 5 +- > include/drm/drm_util.h | 77 +++++++++++++++++++++++++++++++ It's nice that there's less random piling into i915_utils.h, but pushing them into drm_util.h isn't really better. These should all be in include/linux/ somewhere, so that we have as consistent code as possible. drm_util.h should only be a fallback if we get nacks for a more general place and still think it's the right thing to do. i915_util.h has frankyl gone completely bonkers and should die. -Daniel > 2 files changed, 78 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/i915/i915_utils.h b/drivers/gpu/drm/i915/i915_utils.h > index c10d68cdc3ca..345e5b2dc1cd 100644 > --- a/drivers/gpu/drm/i915/i915_utils.h > +++ b/drivers/gpu/drm/i915/i915_utils.h > @@ -32,6 +32,7 @@ > #include <linux/types.h> > #include <linux/workqueue.h> > #include <linux/sched/clock.h> > +#include <drm/drm_util.h> > > #ifdef CONFIG_X86 > #include <asm/hypervisor.h> > @@ -111,10 +112,6 @@ bool i915_error_injected(void); > #define range_overflows_end_t(type, start, size, max) \ > range_overflows_end((type)(start), (type)(size), (type)(max)) > > -/* Note we don't consider signbits :| */ > -#define overflows_type(x, T) \ > - (sizeof(x) > sizeof(T) && (x) >> BITS_PER_TYPE(T)) > - > #define ptr_mask_bits(ptr, n) ({ \ > unsigned long __v = (unsigned long)(ptr); \ > (typeof(ptr))(__v & -BIT(n)); \ > diff --git a/include/drm/drm_util.h b/include/drm/drm_util.h > index 79952d8c4bba..1de9ee5704fa 100644 > --- a/include/drm/drm_util.h > +++ b/include/drm/drm_util.h > @@ -62,6 +62,83 @@ > */ > #define for_each_if(condition) if (!(condition)) {} else > > +/** > + * is_type_unsigned - helper for checking data type which is an unsigned data > + * type or not > + * @x: The data type to check > + * > + * Returns: > + * True if the data type is an unsigned data type, false otherwise. > + */ > +#define is_type_unsigned(x) ((typeof(x))-1 >= (typeof(x))0) > + > +/** > + * overflows_type - helper for checking the truncation between data types > + * @x: Source for overflow type comparison > + * @T: Destination for overflow type comparison > + * > + * It compares the values and size of each data type between the first and > + * second argument to check whether truncation can occur when assigning the > + * first argument to the variable of the second argument. > + * Source and Destination can be used with or without sign bit. > + * Composite data structures such as union and structure are not considered. > + * Enum data types are not considered. > + * Floating point data types are not considered. > + * > + * Returns: > + * True if truncation can occur, false otherwise. > + */ > + > +#define overflows_type(x, T) \ > + (is_type_unsigned(x) ? \ > + is_type_unsigned(T) ? \ > + (sizeof(x) > sizeof(T) && (x) >> BITS_PER_TYPE(T)) ? 1 : 0 \ > + : (sizeof(x) >= sizeof(T) && (x) >> (BITS_PER_TYPE(T) - 1)) ? 1 : 0 \ > + : is_type_unsigned(T) ? \ > + ((x) < 0) ? 1 : (sizeof(x) > sizeof(T) && (x) >> BITS_PER_TYPE(T)) ? 1 : 0 \ > + : (sizeof(x) > sizeof(T)) ? \ > + ((x) < 0) ? (((x) * -1) >> BITS_PER_TYPE(T)) ? 1 : 0 \ > + : ((x) >> BITS_PER_TYPE(T)) ? 1 : 0 \ > + : 0) > + > +/** > + * exact_type - break compile if source type and destination value's type are > + * not the same > + * @T: Source type > + * @n: Destination value > + * > + * It is a helper macro for a poor man's -Wconversion: only allow variables of > + * an exact type. It determines whether the source type and destination value's > + * type are the same while compiling, and it breaks compile if two types are > + * not the same > + */ > +#define exact_type(T, n) \ > + BUILD_BUG_ON(!__builtin_constant_p(n) && !__builtin_types_compatible_p(T, typeof(n))) > + > +/** > + * exactly_pgoff_t - helper to check if the type of a value is pgoff_t > + * @n: value to compare pgoff_t type > + * > + * It breaks compile if the argument value's type is not pgoff_t type. > + */ > +#define exactly_pgoff_t(n) exact_type(pgoff_t, n) > + > +/** > + * safe_conversion - perform a type conversion (cast) of an source value into > + * a new variable, checking that the destination is large enough to hold the > + * source value. > + * @ptr: Destination pointer address > + * @value: Source value > + * > + * Returns: > + * If the value would overflow the destination, it returns false. > + */ > +#define safe_conversion(ptr, value) ({ \ > + typeof(value) __v = (value); \ > + typeof(ptr) __ptr = (ptr); \ > + overflows_type(__v, *__ptr) ? 0 : ((*__ptr = (typeof(*__ptr))__v), 1); \ > +}) > + > /** > * drm_can_sleep - returns true if currently okay to sleep > * > -- > 2.34.1 >
On Thu, 11 Aug 2022, Daniel Vetter <daniel@ffwll.ch> wrote: > On Tue, Jul 19, 2022 at 05:04:18PM +0300, Gwan-gyeong Mun wrote: >> It moves overflows_type utility macro into drm util header from i915_utils >> header. The overflows_type can be used to catch the truncation between data >> types. And it adds safe_conversion() macro which performs a type conversion >> (cast) of an source value into a new variable, checking that the >> destination is large enough to hold the source value. >> And it adds exact_type and exactly_pgoff_t macro to catch type mis-match >> while compiling. >> >> v3: Add is_type_unsigned() macro (Mauro) >> Modify overflows_type() macro to consider signed data types (Mauro) >> Fix the problem that safe_conversion() macro always returns true >> v4: Fix kernel-doc markups >> >> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> >> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> >> Cc: Matthew Auld <matthew.auld@intel.com> >> Cc: Nirmoy Das <nirmoy.das@intel.com> >> Cc: Jani Nikula <jani.nikula@intel.com> >> Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> >> --- >> drivers/gpu/drm/i915/i915_utils.h | 5 +- >> include/drm/drm_util.h | 77 +++++++++++++++++++++++++++++++ > > It's nice that there's less random piling into i915_utils.h, but pushing > them into drm_util.h isn't really better. These should all be in > include/linux/ somewhere, so that we have as consistent code as possible. > > drm_util.h should only be a fallback if we get nacks for a more general > place and still think it's the right thing to do. > > i915_util.h has frankyl gone completely bonkers and should die. Agreed [1]. BR, Jani. [1] https://lore.kernel.org/r/875yj9qv62.fsf@intel.com > -Daniel > >> 2 files changed, 78 insertions(+), 4 deletions(-) >> >> diff --git a/drivers/gpu/drm/i915/i915_utils.h b/drivers/gpu/drm/i915/i915_utils.h >> index c10d68cdc3ca..345e5b2dc1cd 100644 >> --- a/drivers/gpu/drm/i915/i915_utils.h >> +++ b/drivers/gpu/drm/i915/i915_utils.h >> @@ -32,6 +32,7 @@ >> #include <linux/types.h> >> #include <linux/workqueue.h> >> #include <linux/sched/clock.h> >> +#include <drm/drm_util.h> >> >> #ifdef CONFIG_X86 >> #include <asm/hypervisor.h> >> @@ -111,10 +112,6 @@ bool i915_error_injected(void); >> #define range_overflows_end_t(type, start, size, max) \ >> range_overflows_end((type)(start), (type)(size), (type)(max)) >> >> -/* Note we don't consider signbits :| */ >> -#define overflows_type(x, T) \ >> - (sizeof(x) > sizeof(T) && (x) >> BITS_PER_TYPE(T)) >> - >> #define ptr_mask_bits(ptr, n) ({ \ >> unsigned long __v = (unsigned long)(ptr); \ >> (typeof(ptr))(__v & -BIT(n)); \ >> diff --git a/include/drm/drm_util.h b/include/drm/drm_util.h >> index 79952d8c4bba..1de9ee5704fa 100644 >> --- a/include/drm/drm_util.h >> +++ b/include/drm/drm_util.h >> @@ -62,6 +62,83 @@ >> */ >> #define for_each_if(condition) if (!(condition)) {} else >> >> +/** >> + * is_type_unsigned - helper for checking data type which is an unsigned data >> + * type or not >> + * @x: The data type to check >> + * >> + * Returns: >> + * True if the data type is an unsigned data type, false otherwise. >> + */ >> +#define is_type_unsigned(x) ((typeof(x))-1 >= (typeof(x))0) >> + >> +/** >> + * overflows_type - helper for checking the truncation between data types >> + * @x: Source for overflow type comparison >> + * @T: Destination for overflow type comparison >> + * >> + * It compares the values and size of each data type between the first and >> + * second argument to check whether truncation can occur when assigning the >> + * first argument to the variable of the second argument. >> + * Source and Destination can be used with or without sign bit. >> + * Composite data structures such as union and structure are not considered. >> + * Enum data types are not considered. >> + * Floating point data types are not considered. >> + * >> + * Returns: >> + * True if truncation can occur, false otherwise. >> + */ >> + >> +#define overflows_type(x, T) \ >> + (is_type_unsigned(x) ? \ >> + is_type_unsigned(T) ? \ >> + (sizeof(x) > sizeof(T) && (x) >> BITS_PER_TYPE(T)) ? 1 : 0 \ >> + : (sizeof(x) >= sizeof(T) && (x) >> (BITS_PER_TYPE(T) - 1)) ? 1 : 0 \ >> + : is_type_unsigned(T) ? \ >> + ((x) < 0) ? 1 : (sizeof(x) > sizeof(T) && (x) >> BITS_PER_TYPE(T)) ? 1 : 0 \ >> + : (sizeof(x) > sizeof(T)) ? \ >> + ((x) < 0) ? (((x) * -1) >> BITS_PER_TYPE(T)) ? 1 : 0 \ >> + : ((x) >> BITS_PER_TYPE(T)) ? 1 : 0 \ >> + : 0) >> + >> +/** >> + * exact_type - break compile if source type and destination value's type are >> + * not the same >> + * @T: Source type >> + * @n: Destination value >> + * >> + * It is a helper macro for a poor man's -Wconversion: only allow variables of >> + * an exact type. It determines whether the source type and destination value's >> + * type are the same while compiling, and it breaks compile if two types are >> + * not the same >> + */ >> +#define exact_type(T, n) \ >> + BUILD_BUG_ON(!__builtin_constant_p(n) && !__builtin_types_compatible_p(T, typeof(n))) >> + >> +/** >> + * exactly_pgoff_t - helper to check if the type of a value is pgoff_t >> + * @n: value to compare pgoff_t type >> + * >> + * It breaks compile if the argument value's type is not pgoff_t type. >> + */ >> +#define exactly_pgoff_t(n) exact_type(pgoff_t, n) >> + >> +/** >> + * safe_conversion - perform a type conversion (cast) of an source value into >> + * a new variable, checking that the destination is large enough to hold the >> + * source value. >> + * @ptr: Destination pointer address >> + * @value: Source value >> + * >> + * Returns: >> + * If the value would overflow the destination, it returns false. >> + */ >> +#define safe_conversion(ptr, value) ({ \ >> + typeof(value) __v = (value); \ >> + typeof(ptr) __ptr = (ptr); \ >> + overflows_type(__v, *__ptr) ? 0 : ((*__ptr = (typeof(*__ptr))__v), 1); \ >> +}) >> + >> /** >> * drm_can_sleep - returns true if currently okay to sleep >> * >> -- >> 2.34.1 >>
diff --git a/drivers/gpu/drm/i915/i915_utils.h b/drivers/gpu/drm/i915/i915_utils.h index c10d68cdc3ca..345e5b2dc1cd 100644 --- a/drivers/gpu/drm/i915/i915_utils.h +++ b/drivers/gpu/drm/i915/i915_utils.h @@ -32,6 +32,7 @@ #include <linux/types.h> #include <linux/workqueue.h> #include <linux/sched/clock.h> +#include <drm/drm_util.h> #ifdef CONFIG_X86 #include <asm/hypervisor.h> @@ -111,10 +112,6 @@ bool i915_error_injected(void); #define range_overflows_end_t(type, start, size, max) \ range_overflows_end((type)(start), (type)(size), (type)(max)) -/* Note we don't consider signbits :| */ -#define overflows_type(x, T) \ - (sizeof(x) > sizeof(T) && (x) >> BITS_PER_TYPE(T)) - #define ptr_mask_bits(ptr, n) ({ \ unsigned long __v = (unsigned long)(ptr); \ (typeof(ptr))(__v & -BIT(n)); \ diff --git a/include/drm/drm_util.h b/include/drm/drm_util.h index 79952d8c4bba..1de9ee5704fa 100644 --- a/include/drm/drm_util.h +++ b/include/drm/drm_util.h @@ -62,6 +62,83 @@ */ #define for_each_if(condition) if (!(condition)) {} else +/** + * is_type_unsigned - helper for checking data type which is an unsigned data + * type or not + * @x: The data type to check + * + * Returns: + * True if the data type is an unsigned data type, false otherwise. + */ +#define is_type_unsigned(x) ((typeof(x))-1 >= (typeof(x))0) + +/** + * overflows_type - helper for checking the truncation between data types + * @x: Source for overflow type comparison + * @T: Destination for overflow type comparison + * + * It compares the values and size of each data type between the first and + * second argument to check whether truncation can occur when assigning the + * first argument to the variable of the second argument. + * Source and Destination can be used with or without sign bit. + * Composite data structures such as union and structure are not considered. + * Enum data types are not considered. + * Floating point data types are not considered. + * + * Returns: + * True if truncation can occur, false otherwise. + */ + +#define overflows_type(x, T) \ + (is_type_unsigned(x) ? \ + is_type_unsigned(T) ? \ + (sizeof(x) > sizeof(T) && (x) >> BITS_PER_TYPE(T)) ? 1 : 0 \ + : (sizeof(x) >= sizeof(T) && (x) >> (BITS_PER_TYPE(T) - 1)) ? 1 : 0 \ + : is_type_unsigned(T) ? \ + ((x) < 0) ? 1 : (sizeof(x) > sizeof(T) && (x) >> BITS_PER_TYPE(T)) ? 1 : 0 \ + : (sizeof(x) > sizeof(T)) ? \ + ((x) < 0) ? (((x) * -1) >> BITS_PER_TYPE(T)) ? 1 : 0 \ + : ((x) >> BITS_PER_TYPE(T)) ? 1 : 0 \ + : 0) + +/** + * exact_type - break compile if source type and destination value's type are + * not the same + * @T: Source type + * @n: Destination value + * + * It is a helper macro for a poor man's -Wconversion: only allow variables of + * an exact type. It determines whether the source type and destination value's + * type are the same while compiling, and it breaks compile if two types are + * not the same + */ +#define exact_type(T, n) \ + BUILD_BUG_ON(!__builtin_constant_p(n) && !__builtin_types_compatible_p(T, typeof(n))) + +/** + * exactly_pgoff_t - helper to check if the type of a value is pgoff_t + * @n: value to compare pgoff_t type + * + * It breaks compile if the argument value's type is not pgoff_t type. + */ +#define exactly_pgoff_t(n) exact_type(pgoff_t, n) + +/** + * safe_conversion - perform a type conversion (cast) of an source value into + * a new variable, checking that the destination is large enough to hold the + * source value. + * @ptr: Destination pointer address + * @value: Source value + * + * Returns: + * If the value would overflow the destination, it returns false. + */ +#define safe_conversion(ptr, value) ({ \ + typeof(value) __v = (value); \ + typeof(ptr) __ptr = (ptr); \ + overflows_type(__v, *__ptr) ? 0 : ((*__ptr = (typeof(*__ptr))__v), 1); \ +}) + /** * drm_can_sleep - returns true if currently okay to sleep *
It moves overflows_type utility macro into drm util header from i915_utils header. The overflows_type can be used to catch the truncation between data types. And it adds safe_conversion() macro which performs a type conversion (cast) of an source value into a new variable, checking that the destination is large enough to hold the source value. And it adds exact_type and exactly_pgoff_t macro to catch type mis-match while compiling. v3: Add is_type_unsigned() macro (Mauro) Modify overflows_type() macro to consider signed data types (Mauro) Fix the problem that safe_conversion() macro always returns true v4: Fix kernel-doc markups Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Nirmoy Das <nirmoy.das@intel.com> Cc: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> --- drivers/gpu/drm/i915/i915_utils.h | 5 +- include/drm/drm_util.h | 77 +++++++++++++++++++++++++++++++ 2 files changed, 78 insertions(+), 4 deletions(-)