[PATCH] KVM: s390: selftest: memop: Fix undefined behavior

[PATCH] KVM: s390: selftest: memop: Fix undefined behavior

[Nina Schoetterl-Glausch]

If an integer's type has x bits, shifting the integer left by x or more
is undefined behavior.
This can happen in the rotate function when attempting to do a rotation
of the whole value by 0.

Fixes: 0dd714bfd200 ("KVM: s390: selftest: memop: Add cmpxchg tests")
Signed-off-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
---
 tools/testing/selftests/kvm/s390x/memop.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tools/testing/selftests/kvm/s390x/memop.c b/tools/testing/selftests/kvm/s390x/memop.c
index bb3ca9a5d731..2eba9575828e 100644
--- a/tools/testing/selftests/kvm/s390x/memop.c
+++ b/tools/testing/selftests/kvm/s390x/memop.c
@@ -485,11 +485,13 @@ static bool popcount_eq(__uint128_t a, __uint128_t b)
 
 static __uint128_t rotate(int size, __uint128_t val, int amount)
 {
-	unsigned int bits = size * 8;
+	unsigned int left, right, bits = size * 8;
 
-	amount = (amount + bits) % bits;
+	right = (amount + bits) % bits;
+	/* % 128 prevents left shift UB if size == 16 && right == 0 */
+	left = (bits - right) % 128;
 	val = cut_to_size(size, val);
-	return (val << (bits - amount)) | (val >> amount);
+	return (val << left) | (val >> right);
 }
 
 const unsigned int max_block = 16;

base-commit: 305230142ae0637213bf6e04f6d9f10bbcb74af8
-- 
2.40.1

Re: [PATCH] KVM: s390: selftest: memop: Fix undefined behavior

[Claudio Imbrenda]

On Fri, 15 Dec 2023 17:11:25 +0100
Nina Schoetterl-Glausch <nsg@linux.ibm.com> wrote:

> If an integer's type has x bits, shifting the integer left by x or more
> is undefined behavior.
> This can happen in the rotate function when attempting to do a rotation
> of the whole value by 0.

is 0 the only problematic value? because in that case... 

> 
> Fixes: 0dd714bfd200 ("KVM: s390: selftest: memop: Add cmpxchg tests")
> Signed-off-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
> ---
>  tools/testing/selftests/kvm/s390x/memop.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/testing/selftests/kvm/s390x/memop.c b/tools/testing/selftests/kvm/s390x/memop.c
> index bb3ca9a5d731..2eba9575828e 100644
> --- a/tools/testing/selftests/kvm/s390x/memop.c
> +++ b/tools/testing/selftests/kvm/s390x/memop.c
> @@ -485,11 +485,13 @@ static bool popcount_eq(__uint128_t a, __uint128_t b)
>  
>  static __uint128_t rotate(int size, __uint128_t val, int amount)
>  {
> -	unsigned int bits = size * 8;
> +	unsigned int left, right, bits = size * 8;
>  

...why not just:

if (!amount)
	return val;

?

> -	amount = (amount + bits) % bits;
> +	right = (amount + bits) % bits;
> +	/* % 128 prevents left shift UB if size == 16 && right == 0 */
> +	left = (bits - right) % 128;
>  	val = cut_to_size(size, val);
> -	return (val << (bits - amount)) | (val >> amount);
> +	return (val << left) | (val >> right);
>  }
>  
>  const unsigned int max_block = 16;
> 
> base-commit: 305230142ae0637213bf6e04f6d9f10bbcb74af8

Re: [PATCH] KVM: s390: selftest: memop: Fix undefined behavior

[Nina Schoetterl-Glausch]

On Fri, 2023-12-15 at 18:02 +0100, Claudio Imbrenda wrote:
> On Fri, 15 Dec 2023 17:11:25 +0100
> Nina Schoetterl-Glausch <nsg@linux.ibm.com> wrote:
> 
> > If an integer's type has x bits, shifting the integer left by x or more
> > is undefined behavior.
> > This can happen in the rotate function when attempting to do a rotation
> > of the whole value by 0.
> 
> is 0 the only problematic value? because in that case... 
> 
> > 
> > Fixes: 0dd714bfd200 ("KVM: s390: selftest: memop: Add cmpxchg tests")
> > Signed-off-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
> > ---
> >  tools/testing/selftests/kvm/s390x/memop.c | 8 +++++---
> >  1 file changed, 5 insertions(+), 3 deletions(-)
> > 
> > diff --git a/tools/testing/selftests/kvm/s390x/memop.c b/tools/testing/selftests/kvm/s390x/memop.c
> > index bb3ca9a5d731..2eba9575828e 100644
> > --- a/tools/testing/selftests/kvm/s390x/memop.c
> > +++ b/tools/testing/selftests/kvm/s390x/memop.c
> > @@ -485,11 +485,13 @@ static bool popcount_eq(__uint128_t a, __uint128_t b)
> >  
> >  static __uint128_t rotate(int size, __uint128_t val, int amount)
> >  {
> > -	unsigned int bits = size * 8;
> > +	unsigned int left, right, bits = size * 8;
> >  
> 
> ...why not just:
> 
> if (!amount)
> 	return val;
> 
> ?

That works if you move it one statement down (128 would also trigger UB).
% 128 does the trick, is branchless and there is a bit of a symmetry going
on between right and left.
But I can use an early return if you want.

> 
> > -	amount = (amount + bits) % bits;
> > +	right = (amount + bits) % bits;
> > +	/* % 128 prevents left shift UB if size == 16 && right == 0 */
> > +	left = (bits - right) % 128;
> >  	val = cut_to_size(size, val);
> > -	return (val << (bits - amount)) | (val >> amount);
> > +	return (val << left) | (val >> right);
> >  }
> >  
> >  const unsigned int max_block = 16;
> > 
> > base-commit: 305230142ae0637213bf6e04f6d9f10bbcb74af8
> 

Re: [PATCH] KVM: s390: selftest: memop: Fix undefined behavior

[Claudio Imbrenda]

On Mon, 18 Dec 2023 13:18:14 +0100
Nina Schoetterl-Glausch <nsg@linux.ibm.com> wrote:

[...]

> > > diff --git a/tools/testing/selftests/kvm/s390x/memop.c b/tools/testing/selftests/kvm/s390x/memop.c
> > > index bb3ca9a5d731..2eba9575828e 100644
> > > --- a/tools/testing/selftests/kvm/s390x/memop.c
> > > +++ b/tools/testing/selftests/kvm/s390x/memop.c
> > > @@ -485,11 +485,13 @@ static bool popcount_eq(__uint128_t a, __uint128_t b)
> > >  
> > >  static __uint128_t rotate(int size, __uint128_t val, int amount)
> > >  {
> > > -	unsigned int bits = size * 8;
> > > +	unsigned int left, right, bits = size * 8;
> > >    
> > 
> > ...why not just:
> > 
> > if (!amount)
> > 	return val;
> > 
> > ?  
> 
> That works if you move it one statement down (128 would also trigger UB).

oops, yes it has to be after

> % 128 does the trick, is branchless and there is a bit of a symmetry going
> on between right and left.
> But I can use an early return if you want.

I think it's more readable, and furthermore...

> 
> >   
> > > -	amount = (amount + bits) % bits;
> > > +	right = (amount + bits) % bits;
> > > +	/* % 128 prevents left shift UB if size == 16 && right == 0 */
> > > +	left = (bits - right) % 128;
> > >  	val = cut_to_size(size, val);
> > > -	return (val << (bits - amount)) | (val >> amount);

...this is a more idiomatic syntax for a rotate operation 

> > > +	return (val << left) | (val >> right);
> > >  }
> > >  
> > >  const unsigned int max_block = 16;
> > > 
> > > base-commit: 305230142ae0637213bf6e04f6d9f10bbcb74af8  
> >   
>