linux-kernel - Re: [PATCH] futex: avoid undefined behaviour when shift exponent is negative

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.20.1708252308500.2124@nanos>
Date:   Fri, 25 Aug 2017 23:13:47 +0200 (CEST)
From:   Thomas Gleixner <tglx@...utronix.de>
To:     zhong jiang <zhongjiang@...wei.com>
cc:     Ingo Molnar <mingo@...nel.org>, akpm@...ux-foundation.org,
        mingo@...hat.com, minchan@...nel.org, mhocko@...e.com,
        hpa@...or.com, x86@...nel.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, Zhen Lei <thunder.leizhen@...wei.com>
Subject: Re: [PATCH] futex: avoid undefined behaviour when shift exponent is
 negative

On Fri, 25 Aug 2017, zhong jiang wrote:
> From: zhong jiang <zhongjiang@...wei.com>
> Date: Fri, 25 Aug 2017 12:05:56 +0800
> Subject: [PATCH v2] futex: avoid undefined behaviour when shift exponent is
>  negative

Please do not send patches without changing the subject line so it's clear
that there is a new patch.

> using a shift value < 0 or > 31 will get crap as a result. because
> it's just undefined. The issue still disturb me, so I try to fix
> it again by excluding the especially condition.

Which is obsolete now as this code is unified accross all architectures and
the shift issue is addressed in the generic version of it. So all
architectures get the same fix. See:

 http://git.kernel.org/tip/30d6e0a4190d37740e9447e4e4815f06992dd8c3

And no, we won't add that x86 fix before that unification hits mainline
because that undefined behaviour is harmless as it only affects the user
space value of the futex. IOW, the caller gets what it asked for: crap.

Thanks,

	tglx