linux-kernel - Re: [PATCH 1/2] media: v4l2-core: Shifting signed 32-bit value by 31 bits error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9f925e72-4d55-0cfc-ace6-dfe69bbc6903@linuxfoundation.org>
Date:   Tue, 11 Jun 2019 16:27:58 -0600
From:   Shuah Khan <skhan@...uxfoundation.org>
To:     Hans Verkuil <hverkuil-cisco@...all.nl>, mchehab@...nel.org,
        sakari.ailus@...ux.intel.com,
        niklas.soderlund+renesas@...natech.se, ezequiel@...labora.com,
        paul.kocialkowski@...tlin.com
Cc:     Randy Dunlap <rdunlap@...radead.org>, linux-media@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Shuah Khan <skhan@...uxfoundation.org>
Subject: Re: [PATCH 1/2] media: v4l2-core: Shifting signed 32-bit value by 31
 bits error

On 6/11/19 2:50 PM, Hans Verkuil wrote:
> On 6/11/19 9:42 PM, Shuah Khan wrote:
>> On 6/6/19 12:33 AM, Hans Verkuil wrote:
>>> On 6/6/19 5:22 AM, Randy Dunlap wrote:
>>>> On 6/5/19 2:53 PM, Shuah Khan wrote:
>>>>> Fix the following cppcheck error:
>>>>>
>>>>> Checking drivers/media/v4l2-core/v4l2-ioctl.c ...
>>>>> [drivers/media/v4l2-core/v4l2-ioctl.c:1370]: (error) Shifting signed 32-bit value by 31 bits is undefined behaviour
>>>>>
>>>>> Signed-off-by: Shuah Khan <skhan@...uxfoundation.org>
>>>>> ---
>>>>>    drivers/media/v4l2-core/v4l2-ioctl.c | 2 +-
>>>>>    1 file changed, 1 insertion(+), 1 deletion(-)
>>>>>
>>>>> diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
>>>>> index 6859bdac86fe..333e387bafeb 100644
>>>>> --- a/drivers/media/v4l2-core/v4l2-ioctl.c
>>>>> +++ b/drivers/media/v4l2-core/v4l2-ioctl.c
>>>>> @@ -1364,7 +1364,7 @@ static void v4l_fill_fmtdesc(struct v4l2_fmtdesc *fmt)
>>>>>    					(char)((fmt->pixelformat >> 8) & 0x7f),
>>>>>    					(char)((fmt->pixelformat >> 16) & 0x7f),
>>>>>    					(char)((fmt->pixelformat >> 24) & 0x7f),
>>>>> -					(fmt->pixelformat & (1 << 31)) ? "-BE" : "");
>>>>> +					(fmt->pixelformat & BIT(31)) ? "-BE" : "");
>>>>>    			break;
>>>>>    		}
>>>>>    	}
>>>>>
>>>>
>>>> If this builds, I guess #define BIT(x) got pulled in indirectly
>>>> since bits.h nor bitops.h is currently #included in that source file.
>>>>
>>
>> It does build. You are right that I should have included bitops.h
>>
>>>> Documentation/process/submit-checklist.rst rule #1 says:
>>>> 1) If you use a facility then #include the file that defines/declares
>>>>      that facility.  Don't depend on other header files pulling in ones
>>>>      that you use.
>>>>
>>>> Please add #include <linux/bits or bitops.h>
>>>>
>>>
>>> I'm not sure about this patch. '1 << 31' is used all over in the kernel,
>>> including in public headers (e.g. media.h, videodev2.h).
>>>
>>> It seems arbitrary to change it only here, but not anywhere else.
>>>
>>
>> Right. We have several places in the kernel that do that.
>>
>>> In this particular example for the fourcc handling I would prefer to just
>>> use '1U << 31', both in v4l2-ioctl.c and videodev2.h.
>>>
>>
>> If you would like to take the patch, I can send v2 fixing it using
>> 1U << 31 - This is simpler since it doesn't nee additional includes.
> 
> I would like to have this cleaned up in the public media APIs. Those can be
> used by other compilers as well and it makes sense to me not to have
> undefined behavior in those headers.
> 

Great. That is a good point. I will start looking at the public media
APIs.

>>
>>> A separate patch doing the same for MEDIA_ENT_ID_FLAG_NEXT in media.h would
>>> probably be a good idea either: that way the public API at least will do
>>> the right thing.
>>>

Sounds good.

>>
>> I should have explained it better. I wanted to start with one or two
>> places first to see if it is worth our time to fix these:
>>
>> The full kernel cppcheck log for "Shifting signed 32-bit value by 31
>> bits is undefined behaviour" can be found at:
>>
>> https://drive.google.com/file/d/19Xu7UqBGJ7BpzxEp92ZQYb6F8UPrk3z3/view
> 
> I don't think it makes sense to fix this for drivers. If gcc would do this
> wrong, we'd have noticed it ages ago.

Agreed. I am not concerned about it being incorrect. More for silencing
cppcheck. I do agree that it isn't of a great value to us.

> 
> But I think it makes sense to fix this in public headers.
> 

Yes. This would definitely help.

thanks,
-- Shuah