From: Ayush Mittal <ayush.m@samsung.com>
To: aryabinin@virtuozzo.com, dhowells@redhat.com,
james.l.morris@oracle.com, linux-kernel@vger.kernel.org
Cc: v.narang@samsung.com, a.sahrawat@samsung.com,
pankaj.m@samsung.com, Ayush Mittal <ayush.m@samsung.com>
Subject: [PATCH 1/1] mpi: check for shift exponent greater than 31.
Date: Tue, 24 Oct 2017 10:57:03 +0530 [thread overview]
Message-ID: <1508822823-31231-1-git-send-email-ayush.m@samsung.com> (raw)
In-Reply-To: <CGME20171024052942epcas5p48384a3861fbfa90a37a03236828b9b67@epcas5p4.samsung.com>
This patch check for shift exponent greater than 31,
detected by UBSAN.
1)UBSAN: Undefined behaviour in lib/mpi/generic_mpih-lshift.c:57:22
shift exponent 32 is too large for 32-bit type 'long unsigned int'
2)UBSAN: Undefined behaviour in lib/mpi/generic_mpih-lshift.c:60:20
shift exponent 32 is too large for 32-bit type 'long unsigned int'
3)UBSAN: Undefined behaviour in lib/mpi/generic_mpih-rshift.c:57:21
shift exponent 32 is too large for 32-bit type 'long unsigned int'
4) UBSAN: Undefined behaviour in lib/mpi/generic_mpih-rshift.c:60:19
shift exponent 32 is too large for 32-bit type 'long unsigned int'
So instead of undefined behaviour defining behaviour when shift exponent
is greater than 31 then value will be Zero .
Signed-off-by: Ayush Mittal <ayush.m@samsung.com>
Signed-off-by: Vaneet Narang <v.narang@samsung.com>
---
lib/mpi/generic_mpih-lshift.c | 6 +++---
lib/mpi/generic_mpih-rshift.c | 6 +++---
lib/mpi/mpi-internal.h | 3 +++
3 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/lib/mpi/generic_mpih-lshift.c b/lib/mpi/generic_mpih-lshift.c
index 8631892..1c8277e 100644
--- a/lib/mpi/generic_mpih-lshift.c
+++ b/lib/mpi/generic_mpih-lshift.c
@@ -50,14 +50,14 @@
sh_2 = BITS_PER_MPI_LIMB - sh_1;
i = usize - 1;
low_limb = up[i];
- retval = low_limb >> sh_2;
+ retval = MPI_RSHIFT(low_limb, sh_2);
high_limb = low_limb;
while (--i >= 0) {
low_limb = up[i];
- wp[i] = (high_limb << sh_1) | (low_limb >> sh_2);
+ wp[i] = MPI_LSHIFT(high_limb, sh_1) | MPI_RSHIFT(low_limb, sh_2);
high_limb = low_limb;
}
- wp[i] = high_limb << sh_1;
+ wp[i] = MPI_LSHIFT(high_limb, sh_1);
return retval;
}
diff --git a/lib/mpi/generic_mpih-rshift.c b/lib/mpi/generic_mpih-rshift.c
index ffa3288..3a28bdd 100644
--- a/lib/mpi/generic_mpih-rshift.c
+++ b/lib/mpi/generic_mpih-rshift.c
@@ -50,14 +50,14 @@
wp -= 1;
sh_2 = BITS_PER_MPI_LIMB - sh_1;
high_limb = up[0];
- retval = high_limb << sh_2;
+ retval = MPI_LSHIFT(high_limb, sh_2);
low_limb = high_limb;
for (i = 1; i < usize; i++) {
high_limb = up[i];
- wp[i] = (low_limb >> sh_1) | (high_limb << sh_2);
+ wp[i] = MPI_RSHIFT(low_limb, sh_1) | MPI_LSHIFT(high_limb, sh_2);
low_limb = high_limb;
}
- wp[i] = low_limb >> sh_1;
+ wp[i] = MPI_RSHIFT(low_limb, sh_1);
return retval;
}
diff --git a/lib/mpi/mpi-internal.h b/lib/mpi/mpi-internal.h
index 7eceedd..9c94a98 100644
--- a/lib/mpi/mpi-internal.h
+++ b/lib/mpi/mpi-internal.h
@@ -37,6 +37,9 @@
#include <linux/mpi.h>
#include <linux/errno.h>
+#define MPI_LSHIFT(val, shift) (shift >= BITS_PER_MPI_LIMB ? 0 : (val << shift))
+#define MPI_RSHIFT(val, shift) (shift >= BITS_PER_MPI_LIMB ? 0 : (val >> shift))
+
#define log_debug printk
#define log_bug printk
--
1.9.1
next parent reply other threads:[~2017-10-24 5:29 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CGME20171024052942epcas5p48384a3861fbfa90a37a03236828b9b67@epcas5p4.samsung.com>
2017-10-24 5:27 ` Ayush Mittal [this message]
[not found] ` <CGME20171024052942epcas5p48384a3861fbfa90a37a03236828b9b67@epcms5p6>
2017-11-09 14:55 ` Vaneet Narang
2017-11-01 14:10 ` David Howells
[not found] <CGME20171012110658epcas5p14bf46cbbca920da1577ab0d58f06ad67@epcas5p1.samsung.com>
2017-10-12 11:04 ` Ayush Mittal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1508822823-31231-1-git-send-email-ayush.m@samsung.com \
--to=ayush.m@samsung.com \
--cc=a.sahrawat@samsung.com \
--cc=aryabinin@virtuozzo.com \
--cc=dhowells@redhat.com \
--cc=james.l.morris@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=pankaj.m@samsung.com \
--cc=v.narang@samsung.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®