linux-kernel - [PATCH] mul_u64_u64_div_u64: avoid undefined shift value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <7rrs9pn1-n266-3013-9q6n-1osp8r8s0rrn@syhkavp.arg>
Date: Fri, 12 Jul 2024 13:41:46 -0400 (EDT)
From: Nicolas Pitre <nico@...xnic.net>
To: Andrew Morton <akpm@...ux-foundation.org>
cc: Uwe Kleine-König <u.kleine-koenig@...libre.com>, 
    linux-kernel@...r.kernel.org
Subject: [PATCH] mul_u64_u64_div_u64: avoid undefined shift value

From: Nicolas Pitre <npitre@...libre.com>

Shifting a value to its type's size or beyond is undefined. This may 
happen if the product of a * b is not more than 64 bits despite
ilog2(a) + ilog2(b) being 63 and c having no trailing 0 bits.
We end up with shift=0 and n_lo >> shift | (n_hi << (64 - shift).
Take care of that case and add such case to the test module.

Using __builtin_ctzll() with 0 is also undefined so take care of that
case too.

Signed-off-by: Nicolas Pitre <npitre@...libre.com>
Reported-by: kernel test robot <oliver.sang@...el.com>
Closes: https://lore.kernel.org/oe-lkp/202407121652.69e657c5-oliver.sang@intel.com
---

Andrew: up to you to fold this in the original or queue it as is.

diff --git a/lib/math/div64.c b/lib/math/div64.c
index b7fc752463..5faa29208b 100644
--- a/lib/math/div64.c
+++ b/lib/math/div64.c
@@ -212,11 +212,18 @@ u64 mul_u64_u64_div_u64(u64 a, u64 b, u64 c)
 
 #endif
 
+	/* make sure c is not zero, trigger exception otherwise */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdiv-by-zero"
+	if (unlikely(c == 0))
+		return 1/0;
+#pragma GCC diagnostic pop
+
 	int shift = __builtin_ctzll(c);
 
 	/* try reducing the fraction in case the dividend becomes <= 64 bits */
 	if ((n_hi >> shift) == 0) {
-		u64 n = (n_lo >> shift) | (n_hi << (64 - shift));
+		u64 n = shift ? (n_lo >> shift) | (n_hi << (64 - shift)) : n_lo;
 
 		return div64_u64(n, c >> shift);
 		/*
diff --git a/lib/math/test_mul_u64_u64_div_u64.c b/lib/math/test_mul_u64_u64_div_u64.c
index a25640d349..58d058de4e 100644
--- a/lib/math/test_mul_u64_u64_div_u64.c
+++ b/lib/math/test_mul_u64_u64_div_u64.c
@@ -23,6 +23,7 @@ static test_params test_values[] = {
 {        0x1ffffffff,        0x1ffffffff,                0x4, 0xffffffff00000000 },
 { 0xffff000000000000, 0xffff000000000000, 0xffff000000000001, 0xfffeffffffffffff },
 { 0x3333333333333333, 0x3333333333333333, 0x5555555555555555, 0x1eb851eb851eb851 },
+{ 0x7fffffffffffffff,                0x2,                0x3, 0x5555555555555554 },
 { 0xffffffffffffffff,                0x2, 0x8000000000000000,                0x3 },
 { 0xffffffffffffffff,                0x2, 0xc000000000000000,                0x2 },
 { 0xffffffffffffffff, 0x4000000000000004, 0x8000000000000000, 0x8000000000000007 },