Commit d70de805 authored by Kees Cook's avatar Kees Cook
Browse files

overflow: Introduce wrapping_add(), wrapping_sub(), and wrapping_mul() 



Provide helpers that will perform wrapping addition, subtraction, or
multiplication without tripping the arithmetic wrap-around sanitizers. The
first argument is the type under which the wrap-around should happen
with. In other words, these two calls will get very different results:

	wrapping_mul(int, 50, 50) == 2500
	wrapping_mul(u8,  50, 50) ==  196

Add to the selftests to validate behavior and lack of side-effects.

Reviewed-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: default avatarMarco Elver <elver@google.com>
Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 3e19086f

include/linux/overflow.h

+48 −0
Original line number Diff line number Diff line
@@ -65,6 +65,22 @@ static inline bool __must_check __must_check_overflow(bool overflow) 
#define check_add_overflow(a, b, d)	\

	__must_check_overflow(__builtin_add_overflow(a, b, d))



/**

 * wrapping_add() - Intentionally perform a wrapping addition

 * @type: type for result of calculation

 * @a: first addend

 * @b: second addend

 *

 * Return the potentially wrapped-around addition without

 * tripping any wrap-around sanitizers that may be enabled.

 */

#define wrapping_add(type, a, b)				\

	({							\

		type __val;					\

		__builtin_add_overflow(a, b, &__val);		\

		__val;						\

	})



/**

 * check_sub_overflow() - Calculate subtraction with overflow checking

 * @a: minuend; value to subtract from
@@ -79,6 +95,22 @@ static inline bool __must_check __must_check_overflow(bool overflow) 
#define check_sub_overflow(a, b, d)	\

	__must_check_overflow(__builtin_sub_overflow(a, b, d))



/**

 * wrapping_sub() - Intentionally perform a wrapping subtraction

 * @type: type for result of calculation

 * @a: minuend; value to subtract from

 * @b: subtrahend; value to subtract from @a

 *

 * Return the potentially wrapped-around subtraction without

 * tripping any wrap-around sanitizers that may be enabled.

 */

#define wrapping_sub(type, a, b)				\

	({							\

		type __val;					\

		__builtin_sub_overflow(a, b, &__val);		\

		__val;						\

	})



/**

 * check_mul_overflow() - Calculate multiplication with overflow checking

 * @a: first factor
@@ -93,6 +125,22 @@ static inline bool __must_check __must_check_overflow(bool overflow) 
#define check_mul_overflow(a, b, d)	\

	__must_check_overflow(__builtin_mul_overflow(a, b, d))



/**

 * wrapping_mul() - Intentionally perform a wrapping multiplication

 * @type: type for result of calculation

 * @a: first factor

 * @b: second factor

 *

 * Return the potentially wrapped-around multiplication without

 * tripping any wrap-around sanitizers that may be enabled.

 */

#define wrapping_mul(type, a, b)				\

	({							\

		type __val;					\

		__builtin_mul_overflow(a, b, &__val);		\

		__val;						\

	})



/**

 * check_shl_overflow() - Calculate a left-shifted value and check overflow

 * @a: Value to be shifted

lib/overflow_kunit.c

+20 −4
Original line number Diff line number Diff line
@@ -258,20 +258,36 @@ DEFINE_TEST_ARRAY(s64) = { 
									\

	_of = check_ ## op ## _overflow(a, b, &_r);			\

	KUNIT_EXPECT_EQ_MSG(test, _of, of,				\

		"expected "fmt" "sym" "fmt" to%s overflow (type %s)\n",	\

		"expected check "fmt" "sym" "fmt" to%s overflow (type %s)\n",	\

		a, b, of ? "" : " not", #t);				\

	KUNIT_EXPECT_EQ_MSG(test, _r, r,				\

		"expected "fmt" "sym" "fmt" == "fmt", got "fmt" (type %s)\n", \

		"expected check "fmt" "sym" "fmt" == "fmt", got "fmt" (type %s)\n", \

		a, b, r, _r, #t);					\

	/* Check for internal macro side-effects. */			\

	_of = check_ ## op ## _overflow(_a_orig++, _b_orig++, &_r);	\

	KUNIT_EXPECT_EQ_MSG(test, _a_orig, _a_bump, "Unexpected " #op " macro side-effect!\n"); \

	KUNIT_EXPECT_EQ_MSG(test, _b_orig, _b_bump, "Unexpected " #op " macro side-effect!\n"); \

	KUNIT_EXPECT_EQ_MSG(test, _a_orig, _a_bump,			\

		"Unexpected check " #op " macro side-effect!\n");	\

	KUNIT_EXPECT_EQ_MSG(test, _b_orig, _b_bump,			\

		"Unexpected check " #op " macro side-effect!\n");	\

									\

	_r = wrapping_ ## op(t, a, b);					\

	KUNIT_EXPECT_TRUE_MSG(test, _r == r,				\

		"expected wrap "fmt" "sym" "fmt" == "fmt", got "fmt" (type %s)\n", \

		a, b, r, _r, #t);					\

	/* Check for internal macro side-effects. */			\

	_a_orig = a;							\

	_b_orig = b;							\

	_r = wrapping_ ## op(t, _a_orig++, _b_orig++);			\

	KUNIT_EXPECT_EQ_MSG(test, _a_orig, _a_bump,			\

		"Unexpected wrap " #op " macro side-effect!\n");	\

	KUNIT_EXPECT_EQ_MSG(test, _b_orig, _b_bump,			\

		"Unexpected wrap " #op " macro side-effect!\n");	\

} while (0)



#define DEFINE_TEST_FUNC_TYPED(n, t, fmt)				\

static void do_test_ ## n(struct kunit *test, const struct test_ ## n *p) \

{									\

	/* check_{add,sub,mul}_overflow() and wrapping_{add,sub,mul} */	\

	check_one_op(t, fmt, add, "+", p->a, p->b, p->sum, p->s_of);	\

	check_one_op(t, fmt, add, "+", p->b, p->a, p->sum, p->s_of);	\

	check_one_op(t, fmt, sub, "-", p->a, p->b, p->diff, p->d_of);	\