Skip to content
Snippets Groups Projects
Commit b5fc7a89 authored by Linus Torvalds's avatar Linus Torvalds
Browse files
Pull overflow update from Kees Cook:
 "Just a single change to help enforce all callers are actually checking
  the results of the helpers"

* tag 'overflow-v5.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  overflow: Add __must_check attribute to check_*() helpers
parents 8b05418b 9b80e4c4
Branches
Tags
No related merge requests found
...@@ -43,6 +43,16 @@ ...@@ -43,6 +43,16 @@
#define is_non_negative(a) ((a) > 0 || (a) == 0) #define is_non_negative(a) ((a) > 0 || (a) == 0)
#define is_negative(a) (!(is_non_negative(a))) #define is_negative(a) (!(is_non_negative(a)))
/*
* Allows for effectively applying __must_check to a macro so we can have
* both the type-agnostic benefits of the macros while also being able to
* enforce that the return value is, in fact, checked.
*/
static inline bool __must_check __must_check_overflow(bool overflow)
{
return unlikely(overflow);
}
#ifdef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW #ifdef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW
/* /*
* For simplicity and code hygiene, the fallback code below insists on * For simplicity and code hygiene, the fallback code below insists on
...@@ -52,32 +62,32 @@ ...@@ -52,32 +62,32 @@
* alias for __builtin_add_overflow, but add type checks similar to * alias for __builtin_add_overflow, but add type checks similar to
* below. * below.
*/ */
#define check_add_overflow(a, b, d) ({ \ #define check_add_overflow(a, b, d) __must_check_overflow(({ \
typeof(a) __a = (a); \ typeof(a) __a = (a); \
typeof(b) __b = (b); \ typeof(b) __b = (b); \
typeof(d) __d = (d); \ typeof(d) __d = (d); \
(void) (&__a == &__b); \ (void) (&__a == &__b); \
(void) (&__a == __d); \ (void) (&__a == __d); \
__builtin_add_overflow(__a, __b, __d); \ __builtin_add_overflow(__a, __b, __d); \
}) }))
#define check_sub_overflow(a, b, d) ({ \ #define check_sub_overflow(a, b, d) __must_check_overflow(({ \
typeof(a) __a = (a); \ typeof(a) __a = (a); \
typeof(b) __b = (b); \ typeof(b) __b = (b); \
typeof(d) __d = (d); \ typeof(d) __d = (d); \
(void) (&__a == &__b); \ (void) (&__a == &__b); \
(void) (&__a == __d); \ (void) (&__a == __d); \
__builtin_sub_overflow(__a, __b, __d); \ __builtin_sub_overflow(__a, __b, __d); \
}) }))
#define check_mul_overflow(a, b, d) ({ \ #define check_mul_overflow(a, b, d) __must_check_overflow(({ \
typeof(a) __a = (a); \ typeof(a) __a = (a); \
typeof(b) __b = (b); \ typeof(b) __b = (b); \
typeof(d) __d = (d); \ typeof(d) __d = (d); \
(void) (&__a == &__b); \ (void) (&__a == &__b); \
(void) (&__a == __d); \ (void) (&__a == __d); \
__builtin_mul_overflow(__a, __b, __d); \ __builtin_mul_overflow(__a, __b, __d); \
}) }))
#else #else
...@@ -190,21 +200,20 @@ ...@@ -190,21 +200,20 @@
}) })
#define check_add_overflow(a, b, d) \ #define check_add_overflow(a, b, d) __must_check_overflow( \
__builtin_choose_expr(is_signed_type(typeof(a)), \ __builtin_choose_expr(is_signed_type(typeof(a)), \
__signed_add_overflow(a, b, d), \ __signed_add_overflow(a, b, d), \
__unsigned_add_overflow(a, b, d)) __unsigned_add_overflow(a, b, d)))
#define check_sub_overflow(a, b, d) \ #define check_sub_overflow(a, b, d) __must_check_overflow( \
__builtin_choose_expr(is_signed_type(typeof(a)), \ __builtin_choose_expr(is_signed_type(typeof(a)), \
__signed_sub_overflow(a, b, d), \ __signed_sub_overflow(a, b, d), \
__unsigned_sub_overflow(a, b, d)) __unsigned_sub_overflow(a, b, d)))
#define check_mul_overflow(a, b, d) \ #define check_mul_overflow(a, b, d) __must_check_overflow( \
__builtin_choose_expr(is_signed_type(typeof(a)), \ __builtin_choose_expr(is_signed_type(typeof(a)), \
__signed_mul_overflow(a, b, d), \ __signed_mul_overflow(a, b, d), \
__unsigned_mul_overflow(a, b, d)) __unsigned_mul_overflow(a, b, d)))
#endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */ #endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */
...@@ -227,7 +236,7 @@ ...@@ -227,7 +236,7 @@
* '*d' will hold the results of the attempted shift, but is not * '*d' will hold the results of the attempted shift, but is not
* considered "safe for use" if false is returned. * considered "safe for use" if false is returned.
*/ */
#define check_shl_overflow(a, s, d) ({ \ #define check_shl_overflow(a, s, d) __must_check_overflow(({ \
typeof(a) _a = a; \ typeof(a) _a = a; \
typeof(s) _s = s; \ typeof(s) _s = s; \
typeof(d) _d = d; \ typeof(d) _d = d; \
...@@ -237,7 +246,7 @@ ...@@ -237,7 +246,7 @@
*_d = (_a_full << _to_shift); \ *_d = (_a_full << _to_shift); \
(_to_shift != _s || is_negative(*_d) || is_negative(_a) || \ (_to_shift != _s || is_negative(*_d) || is_negative(_a) || \
(*_d >> _to_shift) != _a); \ (*_d >> _to_shift) != _a); \
}) }))
/** /**
* array_size() - Calculate size of 2-dimensional array. * array_size() - Calculate size of 2-dimensional array.
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment