From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752538AbdK3Ofs (ORCPT ); Thu, 30 Nov 2017 09:35:48 -0500 Received: from mx2.suse.de ([195.135.220.15]:47014 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750943AbdK3Ofq (ORCPT ); Thu, 30 Nov 2017 09:35:46 -0500 From: Jiri Slaby To: mingo@redhat.com Cc: linux-kernel@vger.kernel.org, Jiri Slaby , Peter Zijlstra , Darren Hart , Linus Torvalds Subject: [PATCH 1/1] futex: futex_wake_op, fix sign_extend32 sign bits Date: Thu, 30 Nov 2017 15:35:44 +0100 Message-Id: <20171130143544.21009-1-jslaby@suse.cz> X-Mailer: git-send-email 2.15.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org sign_extend32 counts the sign bit parameter from 0, not from 1. So we have to use "11" for 12th bit, not "12". This mistake means we have not allowed negative op and cmp args since commit 30d6e0a4190d ("futex: Remove duplicated code and fix undefined behaviour") till now. Fixes: 30d6e0a4190d ("futex: Remove duplicated code and fix undefined behaviour") Signed-off-by: Jiri Slaby Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Darren Hart Cc: Linus Torvalds --- kernel/futex.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/futex.c b/kernel/futex.c index 4205ce8b8a7a..56712560fb63 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -1564,8 +1564,8 @@ static int futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr) { unsigned int op = (encoded_op & 0x70000000) >> 28; unsigned int cmp = (encoded_op & 0x0f000000) >> 24; - int oparg = sign_extend32((encoded_op & 0x00fff000) >> 12, 12); - int cmparg = sign_extend32(encoded_op & 0x00000fff, 12); + int oparg = sign_extend32((encoded_op & 0x00fff000) >> 12, 11); + int cmparg = sign_extend32(encoded_op & 0x00000fff, 11); int oldval, ret; if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) { -- 2.15.0