On Sun, Jul 08, 2018 at 01:38:32PM +0300, Leon Romanovsky wrote:
> From: Jason Gunthorpe <jgg@xxxxxxxxxxxx>
>
> Add shift_overflow() helper to help driver authors to ensure that
> shift operand doesn't cause to overflow.
>
> Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxxxx>
> Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxxxx>
> ---
> include/linux/overflow.h | 23 +++++++++++++++++++++++
> 1 file changed, 23 insertions(+)
Kees/Rasmus, if you are happy with this please ack, I can run it
through the RDMA tree. Thanks
> diff --git a/include/linux/overflow.h b/include/linux/overflow.h
> index 8712ff70995f..21ff032773e0 100644
> --- a/include/linux/overflow.h
> +++ b/include/linux/overflow.h
> @@ -202,6 +202,29 @@
>
> #endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */
>
> +/*
> + * Compute *d = (a << s)
> + *
> + * Returns true if '*d' cannot hold the result or 'a << s' doesn't make sense.
> + * - 'a << s' causes bits to be lost when stored in d
> + * - 's' is garbage (eg negative) or so large that a << s is guaranteed to be 0
> + * - 'a' is negative
> + * - 'a << s' sets the sign bit, if any, in '*d'
> + * *d is not defined if false is returned.
> + */
> +#define check_shift_overflow(a, s, d) ({ \
> + typeof(a) _a = a; \
> + typeof(s) _s = s; \
> + typeof(d) _d = d; \
> + u64 _a_full = _a; \
> + unsigned int _to_shift = \
> + _s >= 0 && _s < 8 * sizeof(*d) ? _s : 0; \
> + *_d = (_a_full << _to_shift); \
> + *d = *_d; \
> + (_to_shift != _s || *_d < 0 || _a < 0 || \
> + (*_d >> _to_shift) != _a); \
> +})
Somehow this lost its formatting/indenting.. I will fix when applying,
but I strongly recommend using clang-format for this sort of work..
Jason
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
