From: Thomas Gleixner <tglx@linutronix.de> To: zhong jiang <zhongjiang@huawei.com> Cc: Ingo Molnar <mingo@kernel.org>, akpm@linux-foundation.org, mingo@redhat.com, minchan@kernel.org, mhocko@suse.com, hpa@zytor.com, x86@kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] futex: avoid undefined behaviour when shift exponent is negative Date: Thu, 29 Jun 2017 00:13:44 +0200 (CEST) [thread overview] Message-ID: <alpine.DEB.2.20.1706282353190.1890@nanos> (raw) In-Reply-To: <595331FE.3090700@huawei.com> On Wed, 28 Jun 2017, zhong jiang wrote: > On 2017/6/22 0:40, Ingo Molnar wrote: > > * zhong jiang <zhongjiang@huawei.com> wrote: > > > >> when shift expoment is negative, left shift alway zero. therefore, we > >> modify the logic to avoid the warining. > >> > >> Signed-off-by: zhong jiang <zhongjiang@huawei.com> > >> --- > >> arch/x86/include/asm/futex.h | 8 ++++++-- > >> 1 file changed, 6 insertions(+), 2 deletions(-) > >> > >> diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h > >> index b4c1f54..2425fca 100644 > >> --- a/arch/x86/include/asm/futex.h > >> +++ b/arch/x86/include/asm/futex.h > >> @@ -49,8 +49,12 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr) > >> int cmparg = (encoded_op << 20) >> 20; > >> int oldval = 0, ret, tem; > >> > >> - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) > >> - oparg = 1 << oparg; > >> + if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) { > >> + if (oparg >= 0) > >> + oparg = 1 << oparg; > >> + else > >> + oparg = 0; > >> + } > > Could we avoid all these complications by using an unsigned type? > > I think it is not feasible. a negative shift exponent is likely > existence and reasonable. What is reasonable about a negative shift value? > as the above case, oparg is a negative is common. That's simply wrong. If oparg is negative and the SHIFT bit is set then the result is undefined today and there is no way that this can be used at all. On x86: 1 << -1 = 0x80000000 1 << -2048 = 0x00000001 1 << -2047 = 0x00000002 Anything using a shift value < 0 or > 31 will get crap as a result. Rightfully so because it's just undefined. Yes I know that the insanity of user space is unlimited, but anything attempting this is so broken that we cannot break it further by making that shift arg unsigned and actually limit it to 0-31 Thanks, tglx
WARNING: multiple messages have this Message-ID (diff)
From: Thomas Gleixner <tglx@linutronix.de> To: zhong jiang <zhongjiang@huawei.com> Cc: Ingo Molnar <mingo@kernel.org>, akpm@linux-foundation.org, mingo@redhat.com, minchan@kernel.org, mhocko@suse.com, hpa@zytor.com, x86@kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] futex: avoid undefined behaviour when shift exponent is negative Date: Thu, 29 Jun 2017 00:13:44 +0200 (CEST) [thread overview] Message-ID: <alpine.DEB.2.20.1706282353190.1890@nanos> (raw) In-Reply-To: <595331FE.3090700@huawei.com> On Wed, 28 Jun 2017, zhong jiang wrote: > On 2017/6/22 0:40, Ingo Molnar wrote: > > * zhong jiang <zhongjiang@huawei.com> wrote: > > > >> when shift expoment is negative, left shift alway zero. therefore, we > >> modify the logic to avoid the warining. > >> > >> Signed-off-by: zhong jiang <zhongjiang@huawei.com> > >> --- > >> arch/x86/include/asm/futex.h | 8 ++++++-- > >> 1 file changed, 6 insertions(+), 2 deletions(-) > >> > >> diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h > >> index b4c1f54..2425fca 100644 > >> --- a/arch/x86/include/asm/futex.h > >> +++ b/arch/x86/include/asm/futex.h > >> @@ -49,8 +49,12 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr) > >> int cmparg = (encoded_op << 20) >> 20; > >> int oldval = 0, ret, tem; > >> > >> - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) > >> - oparg = 1 << oparg; > >> + if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) { > >> + if (oparg >= 0) > >> + oparg = 1 << oparg; > >> + else > >> + oparg = 0; > >> + } > > Could we avoid all these complications by using an unsigned type? > > I think it is not feasible. a negative shift exponent is likely > existence and reasonable. What is reasonable about a negative shift value? > as the above case, oparg is a negative is common. That's simply wrong. If oparg is negative and the SHIFT bit is set then the result is undefined today and there is no way that this can be used at all. On x86: 1 << -1 = 0x80000000 1 << -2048 = 0x00000001 1 << -2047 = 0x00000002 Anything using a shift value < 0 or > 31 will get crap as a result. Rightfully so because it's just undefined. Yes I know that the insanity of user space is unlimited, but anything attempting this is so broken that we cannot break it further by making that shift arg unsigned and actually limit it to 0-31 Thanks, tglx -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2017-06-28 22:14 UTC|newest] Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-06-21 11:43 [PATCH] futex: avoid undefined behaviour when shift exponent is negative zhong jiang 2017-06-21 16:40 ` Ingo Molnar 2017-06-21 16:40 ` Ingo Molnar 2017-06-28 4:35 ` zhong jiang 2017-06-28 4:35 ` zhong jiang 2017-06-28 21:43 ` hpa 2017-06-28 21:43 ` hpa 2017-06-29 2:12 ` zhong jiang 2017-06-29 2:12 ` zhong jiang 2017-06-29 4:29 ` hpa 2017-06-29 4:29 ` hpa 2017-06-29 5:57 ` zhong jiang 2017-06-29 5:57 ` zhong jiang 2017-06-28 22:13 ` Thomas Gleixner [this message] 2017-06-28 22:13 ` Thomas Gleixner 2017-06-29 1:54 ` zhong jiang 2017-06-29 1:54 ` zhong jiang 2017-06-29 6:33 ` Thomas Gleixner 2017-06-29 6:33 ` Thomas Gleixner 2017-06-29 7:04 ` zhong jiang 2017-06-29 7:04 ` zhong jiang 2017-08-25 5:21 ` zhong jiang 2017-08-25 5:21 ` zhong jiang 2017-08-25 21:13 ` Thomas Gleixner 2017-08-25 21:13 ` Thomas Gleixner 2017-08-26 2:51 ` zhong jiang 2017-08-26 2:51 ` zhong jiang
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=alpine.DEB.2.20.1706282353190.1890@nanos \ --to=tglx@linutronix.de \ --cc=akpm@linux-foundation.org \ --cc=hpa@zytor.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=mhocko@suse.com \ --cc=minchan@kernel.org \ --cc=mingo@kernel.org \ --cc=mingo@redhat.com \ --cc=x86@kernel.org \ --cc=zhongjiang@huawei.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.