From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751797AbbLRKzk (ORCPT ); Fri, 18 Dec 2015 05:55:40 -0500 Received: from mailout3.w1.samsung.com ([210.118.77.13]:44988 "EHLO mailout3.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751710AbbLRKzi (ORCPT ); Fri, 18 Dec 2015 05:55:38 -0500 X-AuditID: cbfec7f4-f79026d00000418a-92-5673e627bcb3 From: Andrzej Hajda To: linux-kernel@vger.kernel.org Cc: Andrzej Hajda , Bartlomiej Zolnierkiewicz , Marek Szyprowski , Andrew Morton , Viresh Kumar Subject: [PATCH] err.h: add type checking to IS_ERR_VALUE macro Date: Fri, 18 Dec 2015 11:55:02 +0100 Message-id: <1450436102-6360-1-git-send-email-a.hajda@samsung.com> X-Mailer: git-send-email 1.9.1 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrEJMWRmVeSWpSXmKPExsVy+t/xq7rqz4rDDN5/47O4te4cq8Wc9WvY LDbOWM9qcXnXHDaLtUfuslts/OrhwOZx59oeNo8TM36zePRtWcXo8XmTXABLFJdNSmpOZllq kb5dAlfG22trWQveClRcW76IqYHxOm8XIyeHhICJxJpL3awQtpjEhXvr2boYuTiEBJYySrz4 38gM4TQxSeyasoINpIpNQFPi7+abYLaIgILE5t5nrCBFzAJPGSX2zp3ADJIQFrCXWHP/MwuI zSKgKnHj9w1GEJtXwEli4dPT7BDr5CROHpvMOoGRewEjwypG0dTS5ILipPRcQ73ixNzi0rx0 veT83E2MkJD4soNx8TGrQ4wCHIxKPLwGbMVhQqyJZcWVuYcYJTiYlUR4BY8DhXhTEiurUovy 44tKc1KLDzFKc7AoifPO3fU+REggPbEkNTs1tSC1CCbLxMEp1cDYkPsi3eXjvHdeExfWrNCs uJo6q/zOds2VTz7udvl940Wm3mT75/cXWWpOWmd/dIbAgWXSJ/y5pOq7++ctd9a/1fOt/ivP xp5vE2Zwc5/InGC74dTLeIY32g3Kb/1KDFsz/JU+O/Lpvg4peneoeOthzbvHZW6tZ1spmP9t svH8oq/GcwqnmopvU2Ipzkg01GIuKk4EAFKi3wgFAgAA Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org IS_ERR_VALUE used with some common types can work not as expected. The problem affects all unsigned types shorter than ulong and signed types longer than ulong. The patch add compile time checker which reports bug in case wrong type is passed to the macro. Type checking is performed by testing if value of -MAX_ERRNO differes if casted to argument type and to ulong. Signed-off-by: Andrzej Hajda --- Hi, Current implementation of IS_ERR_VALUE does not check type of its arguments. It can result in subtle bugs in the code, especially when compiled for 64bit architectures. The patch tries to solve it by adding error checking. Another solution is to change semantic of the macro, for example: if (typeof(x) is signed) return x < 0; else return x >= ((typeof(x))-MAX_ERRNO; For me the latter is more natural, but changes semantic. I can prepare patch if it is preferable. I suppose "typeof(x) is signed" can be implemented by: (typeof(x))(-1) < 0 and 'if' clause can be replaced by __builtin_choose_expr. Finally simplified SmPL patch to find all occurences of suspected code: virtual context @@ typedef bool, u8, u16, u32, s64; {unsigned char, unsigned short, unsigned int, long long, bool, u8, u16, u32, s64} e; position p; @@ * IS_ERR_VALUE(e@p) It detected about 20 suspects. Regards Andrzej --- include/linux/err.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/include/linux/err.h b/include/linux/err.h index 56762ab..5cdf849 100644 --- a/include/linux/err.h +++ b/include/linux/err.h @@ -1,6 +1,7 @@ #ifndef _LINUX_ERR_H #define _LINUX_ERR_H +#include #include #include @@ -18,7 +19,11 @@ #ifndef __ASSEMBLY__ -#define IS_ERR_VALUE(x) unlikely((x) >= (unsigned long)-MAX_ERRNO) +#define IS_ERR_VALUE(x) \ +({ \ + BUILD_BUG_ON_MSG((typeof(x))(-MAX_ERRNO) != (unsigned long)-MAX_ERRNO, "Invalid IS_ERR_VALUE argument type");\ + unlikely((x) >= (unsigned long)-MAX_ERRNO);\ +}) static inline void * __must_check ERR_PTR(long error) { -- 1.9.1