Re: Kernel oops caused by signed divide

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




On 9/10/24 8:21 AM, Alexei Starovoitov wrote:
On Tue, Sep 10, 2024 at 8:18 AM Yonghong Song <yonghong.song@xxxxxxxxx> wrote:

On 9/10/24 7:44 AM, Dave Thaler wrote:
Yonghong Song wrote:
[...]
In verifier, we have
     /* [R,W]x div 0 -> 0 */
     /* [R,W]x mod 0 -> [R,W]x */

What the value for
     Rx_a sdiv Rx_b -> ?
where Rx_a = INT64_MIN and Rx_b = -1?

Should we just do
     INT64_MIN sdiv -1 -> -1
or some other values?
What happens for BPF_NEG INT64_MIN?
Right. This is equivalent to INT64_MIN/-1. Indeed, we need check and protect for this case as well.
why? what's wrong with bpf_neg -1 ?

I think you are right. 'bpf_neg <num>' should not cause any exception.
In this particular case 'bpf_neg LLONG_MIN' equals LLONG_MIN.

On arm64,

# cat t4.c
#include <stdio.h>
#include <limits.h>
int main(void) {
  volatile long long a = LLONG_MIN;
  printf("-a = %lld\n", -a);
  return 0;
}
# gcc -O2 t4.c && ./a.out
-a = -9223372036854775808

In the above -a also equals LLONG_MIN.

On x86, we get the same result.

$ uname -a
Linux ... #1 SMP Wed Jun  5 06:21:21 PDT 2024 x86_64 x86_64 x86_64 GNU/Linux
$ cat t4.c
#include <stdio.h>
#include <limits.h>
int main(void) {
  volatile long long a = LLONG_MIN;
  printf("-a = %lld\n", -a);
  return 0;
}
$ gcc -O2 t4.c && ./a.out
-a = -9223372036854775808
$ clang -O2 t4.c && ./a.out
-a = -9223372036854775808







[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux