This is a note to let you know that I've just added the patch titled
word-at-a-time: avoid undefined behaviour in zero_bytemask macro
to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
word-at-a-time-avoid-undefined-behaviour-in-zero_bytemask-macro.patch
and it can be found in the queue-3.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From ec6931b281797b69e6cf109f9cc94d5a2bf994e0 Mon Sep 17 00:00:00 2001
From: Will Deacon <will.deacon@xxxxxxx>
Date: Wed, 23 Apr 2014 17:52:52 +0100
Subject: word-at-a-time: avoid undefined behaviour in zero_bytemask macro
From: Will Deacon <will.deacon@xxxxxxx>
commit ec6931b281797b69e6cf109f9cc94d5a2bf994e0 upstream.
The asm-generic, big-endian version of zero_bytemask creates a mask of
bytes preceding the first zero-byte by left shifting ~0ul based on the
position of the first zero byte.
Unfortunately, if the first (top) byte is zero, the output of
prep_zero_mask has only the top bit set, resulting in undefined C
behaviour as we shift left by an amount equal to the width of the type.
As it happens, GCC doesn't manage to spot this through the call to fls(),
but the issue remains if architectures choose to implement their shift
instructions differently.
An example would be arch/arm/ (AArch32), where LSL Rd, Rn, #32 results
in Rd == 0x0, whilst on arch/arm64 (AArch64) LSL Xd, Xn, #64 results in
Xd == Xn.
Rather than check explicitly for the problematic shift, this patch adds
an extra shift by 1, replacing fls with __fls. Since zero_bytemask is
never called with a zero argument (has_zero() is used to check the data
first), we don't need to worry about calling __fls(0), which is
undefined.
Cc: Victor Kamensky <victor.kamensky@xxxxxxxxxx>
Signed-off-by: Will Deacon <will.deacon@xxxxxxx>
Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
include/asm-generic/word-at-a-time.h | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/include/asm-generic/word-at-a-time.h
+++ b/include/asm-generic/word-at-a-time.h
@@ -50,11 +50,7 @@ static inline bool has_zero(unsigned lon
}
#ifndef zero_bytemask
-#ifdef CONFIG_64BIT
-#define zero_bytemask(mask) (~0ul << fls64(mask))
-#else
-#define zero_bytemask(mask) (~0ul << fls(mask))
-#endif /* CONFIG_64BIT */
-#endif /* zero_bytemask */
+#define zero_bytemask(mask) (~0ul << __fls(mask) << 1)
+#endif
#endif /* _ASM_WORD_AT_A_TIME_H */
Patches currently in stable-queue which might be from will.deacon@xxxxxxx are
queue-3.14/arm-8030-1-arm-kdump-add-arch_crash_save_vmcoreinfo.patch
queue-3.14/word-at-a-time-avoid-undefined-behaviour-in-zero_bytemask-macro.patch
queue-3.14/arm-7954-1-mm-remove-remaining-domain-support-from-armv6.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html