linux-kernel - Re: older gccs and case labels producing integer constants

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yk1lodskz34cmqJ1@tucnak>
Date:   Wed, 6 Apr 2022 12:04:17 +0200
From:   Jakub Jelinek <jakub@...hat.com>
To:     Borislav Petkov <bp@...en8.de>, Richard Biener <rguenther@...e.de>,
        linux-toolchains@...r.kernel.org, Michael Matz <matz@...e.de>,
        lkml <linux-kernel@...r.kernel.org>
Subject: Re: older gccs and case labels producing integer constants

On Wed, Apr 06, 2022 at 11:53:17AM +0200, Jakub Jelinek wrote:
> On Tue, Apr 05, 2022 at 12:36:58PM +0200, Borislav Petkov wrote:
> > On Tue, Apr 05, 2022 at 12:06:45PM +0200, Richard Biener wrote:
> > > Wird auch mit gcc 11 rejected.  Kanns sein dass mit gcc 7 andere
> > > compiler flags genommen werden?
> > 
> > Found it:
> > 
> > $ gcc -fsanitize=shift -c switch.c
> > switch.c: In function ‘foo’:
> > switch.c:10:7: error: case label does not reduce to an integer constant
> >        case (((0xfc08) << 16) | (0x0101)):;
> > 
> > $ gcc --version
> > gcc (SUSE Linux) 7.4.1 20190905 [gcc-7-branch revision 275407]
> > Copyright (C) 2017 Free Software Foundation, Inc.
> > 
> > Something not fully backported?
> 
> That is rejected with -fsanitize=shift even on current trunk (in C, C++ is
> fine).
> C++ constexpr code has cases for ubsan builtins and internal functions,
> but C just doesn't handle those apparently.

But I think the error is actually correct.
In C99 and later, for signed left shift the rule for x << y is that
there is UB if (similarly to all C family) if y is negative or greater or
equal to precision of promoted x, but for C99 also when
((unsigned_typeof_x) x >> (precision_of_x - 1 - y)) != 0.
That is the case above, 0xfc08 is signed int and 0xfc08 << 16 is
0xfc080000 where (0xfc08 >> 15) is 1 and so it is UB.
In C99 and later you need:
	case (int)(((0xfc08U) << 16) | (0x0101)):;
or so.
Note, C++ has different rules (and C++20 and later only has the
y non-negative and less than precision requirement and nothing else).

	Jakub