Messages in this thread | | | Date | Mon, 26 Sep 2022 16:46:42 +0300 | From | Andy Shevchenko <> | Subject | Re: [PATCH v3 1/2] minmax: sanity check constant bounds when clamping |
| |
On Mon, Sep 26, 2022 at 03:34:34PM +0200, Jason A. Donenfeld wrote: > The clamp family of functions only makes sense if hi>=lo. If hi and lo > are compile-time constants, then raise a build error. Doing so has > already caught buggy code. This also introduces the infrastructure to > improve the clamping function in subsequent commits.
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Thanks!
> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com> > Cc: Andrew Morton <akpm@linux-foundation.org> > Cc: Kees Cook <keescook@chromium.org> > Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> > --- > include/linux/minmax.h | 26 ++++++++++++++++++++++++-- > 1 file changed, 24 insertions(+), 2 deletions(-) > > diff --git a/include/linux/minmax.h b/include/linux/minmax.h > index 5433c08fcc68..293a66ad7830 100644 > --- a/include/linux/minmax.h > +++ b/include/linux/minmax.h > @@ -37,6 +37,28 @@ > __cmp(x, y, op), \ > __cmp_once(x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y), op)) > > +#define __clamp(val, lo, hi) \ > + __cmp(__cmp(val, lo, >), hi, <) > + > +#define __clamp_once(val, lo, hi, unique_val, unique_lo, unique_hi) ({ \ > + typeof(val) unique_val = (val); \ > + typeof(lo) unique_lo = (lo); \ > + typeof(hi) unique_hi = (hi); \ > + __clamp(unique_val, unique_lo, unique_hi); }) > + > +#define __clamp_input_check(lo, hi) \ > + (BUILD_BUG_ON_ZERO(__builtin_choose_expr( \ > + __is_constexpr((lo) > (hi)), (lo) > (hi), false))) > + > +#define __careful_clamp(val, lo, hi) ({ \ > + __clamp_input_check(lo, hi) + \ > + __builtin_choose_expr(__typecheck(val, lo) && __typecheck(val, hi) && \ > + __typecheck(hi, lo) && __is_constexpr(val) && \ > + __is_constexpr(lo) && __is_constexpr(hi), \ > + __clamp(val, lo, hi), \ > + __clamp_once(val, lo, hi, __UNIQUE_ID(__val), \ > + __UNIQUE_ID(__lo), __UNIQUE_ID(__hi))); }) > + > /** > * min - return minimum of two values of the same or compatible types > * @x: first value > @@ -86,7 +108,7 @@ > * This macro does strict typechecking of @lo/@hi to make sure they are of the > * same type as @val. See the unnecessary pointer comparisons. > */ > -#define clamp(val, lo, hi) min((typeof(val))max(val, lo), hi) > +#define clamp(val, lo, hi) __careful_clamp(val, lo, hi) > > /* > * ..and if you can't take the strict > @@ -121,7 +143,7 @@ > * This macro does no typechecking and uses temporary variables of type > * @type to make all the comparisons. > */ > -#define clamp_t(type, val, lo, hi) min_t(type, max_t(type, val, lo), hi) > +#define clamp_t(type, val, lo, hi) __careful_clamp((type)(val), (type)(lo), (type)(hi)) > > /** > * clamp_val - return a value clamped to a given range using val's type > -- > 2.37.3 >
-- With Best Regards, Andy Shevchenko
| |