From patchwork Wed Aug 1 06:09:45 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10551723 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6168015E9 for ; Wed, 1 Aug 2018 06:10:10 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3DC142A4F0 for ; Wed, 1 Aug 2018 06:10:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 308552A51C; Wed, 1 Aug 2018 06:10:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 06B8A2A4E8 for ; Wed, 1 Aug 2018 06:10:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733057AbeHAHxu (ORCPT ); Wed, 1 Aug 2018 03:53:50 -0400 Received: from mail-pl0-f66.google.com ([209.85.160.66]:41306 "EHLO mail-pl0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727829AbeHAHxt (ORCPT ); Wed, 1 Aug 2018 03:53:49 -0400 Received: by mail-pl0-f66.google.com with SMTP id w8-v6so8271381ply.8 for ; Tue, 31 Jul 2018 23:09:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=I/bSHgCgLfsKi5nn/mcCzY507EwWlFvKmT6sX7YW6BM=; b=lRlOdgOvYtfW4Ixe2fC290TJNndKz0k6abDY61HVuhINVVpGAugFlKTTwdTNQx8+Mr IQ1SoN7H/GpgYKmIxFZNTuWBOKic8/w6wSM4MXoQ6zZFz7vxnkRLJ7r2aUjbiCdYGgFe MBOUdz0ianMIp+Bm4H1gV8YMDK8DdGk3l8igA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=I/bSHgCgLfsKi5nn/mcCzY507EwWlFvKmT6sX7YW6BM=; b=n7seBfElJvUaa8dRaY7ITP9qrxqDrP2DgUvla5poHd1HjE4OaCoiGc7EMjI169wUVJ QvrLOOGA6qJJ/pLndDigmI2XjGTBovdgdQDLmUf1dsAZqL356cE3YCVnAiJ8wB+I2btI xWROWe1BUwIwvOhAw21rrJRRWg+sY+8nWEodRt8LFHICY/DRdle0/g6BFuGa9oyNhAfp NvUzBgJQkOm97jmI91uzoBPtj2IFsGlqlw0QapKUGkBV7rc0krNmeea90cs8x6NzFSS4 CwTIMCYpcL7l9KZhooEkOk7n5b4b130rsD1OJkVsDiPrfV2RFTBd50CDar7BIO/kFHMI zvLA== X-Gm-Message-State: AOUpUlGPO7xDBOhAClKtME5Xeeoc+RPMihsYbi01GFzQUzIU4Pn9QD9H RY+LObpvMgcOuzYIIo3boOOcbQ== X-Google-Smtp-Source: AAOMgpfmUImdbXZBeszOToW3/mDD9Nrp2R7jJY9uiADxozoHu8vmMvZT8Z1mPvc9A8d3TS5hu137VA== X-Received: by 2002:a17:902:6f02:: with SMTP id w2-v6mr22742023plk.216.1533103792732; Tue, 31 Jul 2018 23:09:52 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id y5-v6sm49036946pfj.169.2018.07.31.23.09.49 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 31 Jul 2018 23:09:49 -0700 (PDT) From: Kees Cook To: Rasmus Villemoes Cc: Kees Cook , Jason Gunthorpe , Leon Romanovsky , Jason Gunthorpe , Leon Romanovsky , Bart Van Assche , Doug Ledford , Dan Carpenter , linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 1/3] overflow.h: Add arithmetic shift helper Date: Tue, 31 Jul 2018 23:09:45 -0700 Message-Id: <20180801060947.16670-2-keescook@chromium.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180801060947.16670-1-keescook@chromium.org> References: <20180801060947.16670-1-keescook@chromium.org> Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Jason Gunthorpe Add shift_overflow() helper to assist driver authors in ensuring that shift operations don't cause overflows or other odd conditions. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky [kees: tweaked comments and commit log, dropped unneeded assignment] Signed-off-by: Kees Cook --- include/linux/overflow.h | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/include/linux/overflow.h b/include/linux/overflow.h index 8712ff70995f..69fc366ce865 100644 --- a/include/linux/overflow.h +++ b/include/linux/overflow.h @@ -202,6 +202,37 @@ #endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */ +/** check_shift_overflow() - Calculate a left-shifted value and check overflow + * + * @a: Value to be shifted + * @b: How many bits left to shift + * @d: Pointer to where to store the result + * + * Computes *@d = (@a << @s) + * + * Returns true if '*d' cannot hold the result or when 'a << s' doesn't + * make sense. Example conditions: + * - 'a << s' causes bits to be lost when stored in *d. + * - 's' is garbage (e.g. negative) or so large that the result of + * 'a << s' is guaranteed to be 0. + * - 'a' is negative. + * - 'a << s' sets the sign bit, if any, in '*d'. + * + * '*d' will hold the results of the attempted shift, but is not + * considered "safe for use" if false is returned. + */ +#define check_shift_overflow(a, s, d) ({ \ + typeof(a) _a = a; \ + typeof(s) _s = s; \ + typeof(d) _d = d; \ + u64 _a_full = _a; \ + unsigned int _to_shift = \ + _s >= 0 && _s < 8 * sizeof(*d) ? _s : 0; \ + *_d = (_a_full << _to_shift); \ + (_to_shift != _s || *_d < 0 || _a < 0 || \ + (*_d >> _to_shift) != _a); \ +}) + /** * array_size() - Calculate size of 2-dimensional array. *