linux-kernel - [PATCH 2/2] rust: time: Use wrapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240411230801.1504496-3-boqun.feng@gmail.com>
Date: Thu, 11 Apr 2024 16:08:01 -0700
From: Boqun Feng <boqun.feng@...il.com>
To: Thomas Gleixner <tglx@...utronix.de>,
	Miguel Ojeda <ojeda@...nel.org>
Cc: John Stultz <jstultz@...gle.com>,
	Stephen Boyd <sboyd@...nel.org>,
	Alex Gaynor <alex.gaynor@...il.com>,
	Wedson Almeida Filho <wedsonaf@...il.com>,
	Boqun Feng <boqun.feng@...il.com>,
	Gary Guo <gary@...yguo.net>,
	bjorn3_gh@...tonmail.com,
	Benno Lossin <benno.lossin@...ton.me>,
	Andreas Hindborg <a.hindborg@...sung.com>,
	Alice Ryhl <aliceryhl@...gle.com>,
	rust-for-linux@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH 2/2] rust: time: Use wrapping_sub() for Ktime::sub()

Currently since Rust code is compiled with "-Coverflow-checks=y", so a
normal substraction may be compiled as an overflow checking and panic
if overflow happens:

        subq    %rsi, %rdi
        jo      .LBB0_2
        movq    %rdi, %rax
        retq
LBB0_2:
        pushq   %rax
        leaq    str.0(%rip), %rdi
        leaq    .L__unnamed_1(%rip), %rdx
        movl    $33, %esi
        callq   *core::panicking::panic::h59297120e85ea178@...PCREL(%rip)

although overflow detection is nice to have, however this makes
`Ktime::sub()` behave differently than `ktime_sub()`, moreover it's not
clear that the overflow checking is helpful, since for example, the
current binder usage[1] doesn't have the checking.

Therefore make `Ktime::sub()` have the same semantics as `ktime_sub()`:
overflow behaves like 2s-complement wrapping sub.

Link: https://lore.kernel.org/lkml/5ac8c0d09392290be789423f0dd78a520b830fab.1682333709.git.zhangchuang3@xiaomi.com/ [1]
Signed-off-by: Boqun Feng <boqun.feng@...il.com>
---
 rust/kernel/time.rs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/rust/kernel/time.rs b/rust/kernel/time.rs
index e3bb5e89f88d..3cb15d3079f4 100644
--- a/rust/kernel/time.rs
+++ b/rust/kernel/time.rs
@@ -77,7 +77,9 @@ impl core::ops::Sub for Ktime {
     #[inline]
     fn sub(self, other: Ktime) -> Ktime {
         Self {
-            inner: self.inner - other.inner,
+            // Mirrors `ktime_sub()`, kernel defines signed overflow to behave like 2s-complement,
+            // hence `wrapping_sub()` is used.
+            inner: self.inner.wrapping_sub(other.inner),
         }
     }
 }
-- 
2.44.0