From patchwork Wed Aug 1 00:00:37 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10551553 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 830F013BF for ; Wed, 1 Aug 2018 00:01:06 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 70D602A5FC for ; Wed, 1 Aug 2018 00:01:06 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 608C92AFEA; Wed, 1 Aug 2018 00:01:06 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F284E2A5FC for ; Wed, 1 Aug 2018 00:01:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732854AbeHABnd (ORCPT ); Tue, 31 Jul 2018 21:43:33 -0400 Received: from mail-pl0-f67.google.com ([209.85.160.67]:44932 "EHLO mail-pl0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732805AbeHABnc (ORCPT ); Tue, 31 Jul 2018 21:43:32 -0400 Received: by mail-pl0-f67.google.com with SMTP id m16-v6so7865529pls.11 for ; Tue, 31 Jul 2018 17:00:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=I/bSHgCgLfsKi5nn/mcCzY507EwWlFvKmT6sX7YW6BM=; b=mhT7DTJxVJJoAYSdt0UZ/7ZB1XpO0tvKo3LeJcciBZD7CSVIG/5E/p+5BzuZDiCWR/ MrtzSIe4g1Tmj6k9Y3Qy+oe+cCOqlITK/h8DuwbDB2P1NzCbH5LEXSMgfmVyfN65/fQ1 8gb9CEjboJCxNyyWQbNq3QZJE1rYxjxUQoIdQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=I/bSHgCgLfsKi5nn/mcCzY507EwWlFvKmT6sX7YW6BM=; b=s6lv4FMxZ3cHLlqnKGsIOPHN/ccd4u2b9JdctQ1Ykuyb/dtTf9CjzUBVI+hwC8Gjz2 SbgyIUgVUuhvOTMeVyqIBfS+n4pNgzksDOcNIAmN3Ub8TZM68sSmTmSKk3sw6QcQrA+K S7Ga5efDkmyiTFPl29nNL/txbrDUVaLPld0ExL+InKWUZ5QbBEOg2dQ/47hzoNykz9eF zQrQcrwnOYs7stLvH8SHl5HyB8jn5WNkuIWTxu3iHPb9NisyCGvG8byZ+fbBdFYCkHaF ba8lSOhnpxEege5F6LwXK33Y7KbO5lnSUA5OzCHfazzeUm+MpRRPP/zg34g769BDptg1 Fhhw== X-Gm-Message-State: AOUpUlFrYBD4YHvc1rjAa8BrkQx2bO7c4TIXUsfR5GntHXeTOb6doK+/ AHjkjtHdxaDgfdveu3Gs+7z6cw== X-Google-Smtp-Source: AAOMgpcV3exqU+XKoTv3t/lJwCop6bAlog7ty6CDElZ7+0d3bCwJ6q5LOqPXcyMp78m6hCHJwPIgvg== X-Received: by 2002:a17:902:9693:: with SMTP id n19-v6mr22496689plp.212.1533081647203; Tue, 31 Jul 2018 17:00:47 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id q21-v6sm27421107pfl.156.2018.07.31.17.00.43 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 31 Jul 2018 17:00:44 -0700 (PDT) From: Kees Cook To: Rasmus Villemoes Cc: Kees Cook , Jason Gunthorpe , Leon Romanovsky , Jason Gunthorpe , Leon Romanovsky , Bart Van Assche , Doug Ledford , Dan Carpenter , linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/3] overflow.h: Add arithmetic shift helper Date: Tue, 31 Jul 2018 17:00:37 -0700 Message-Id: <20180801000039.44314-2-keescook@chromium.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180801000039.44314-1-keescook@chromium.org> References: <20180801000039.44314-1-keescook@chromium.org> Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Jason Gunthorpe Add shift_overflow() helper to assist driver authors in ensuring that shift operations don't cause overflows or other odd conditions. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky [kees: tweaked comments and commit log, dropped unneeded assignment] Signed-off-by: Kees Cook --- include/linux/overflow.h | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/include/linux/overflow.h b/include/linux/overflow.h index 8712ff70995f..69fc366ce865 100644 --- a/include/linux/overflow.h +++ b/include/linux/overflow.h @@ -202,6 +202,37 @@ #endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */ +/** check_shift_overflow() - Calculate a left-shifted value and check overflow + * + * @a: Value to be shifted + * @b: How many bits left to shift + * @d: Pointer to where to store the result + * + * Computes *@d = (@a << @s) + * + * Returns true if '*d' cannot hold the result or when 'a << s' doesn't + * make sense. Example conditions: + * - 'a << s' causes bits to be lost when stored in *d. + * - 's' is garbage (e.g. negative) or so large that the result of + * 'a << s' is guaranteed to be 0. + * - 'a' is negative. + * - 'a << s' sets the sign bit, if any, in '*d'. + * + * '*d' will hold the results of the attempted shift, but is not + * considered "safe for use" if false is returned. + */ +#define check_shift_overflow(a, s, d) ({ \ + typeof(a) _a = a; \ + typeof(s) _s = s; \ + typeof(d) _d = d; \ + u64 _a_full = _a; \ + unsigned int _to_shift = \ + _s >= 0 && _s < 8 * sizeof(*d) ? _s : 0; \ + *_d = (_a_full << _to_shift); \ + (_to_shift != _s || *_d < 0 || _a < 0 || \ + (*_d >> _to_shift) != _a); \ +}) + /** * array_size() - Calculate size of 2-dimensional array. *