package/kernel/mac80211/patches/011-backport-overflow_h.patch

   1 --- a/backport-include/linux/slab.h
   2 +++ b/backport-include/linux/slab.h
   3 @@ -1,6 +1,7 @@
   4  #ifndef __BACKPORT_SLAB_H
   5  #define __BACKPORT_SLAB_H
   6  #include_next <linux/slab.h>
   7 +#include <linux/overflow.h>
   8  #include <linux/version.h>
   9
  10  #if LINUX_VERSION_IS_LESS(3,4,0)
  11 --- /dev/null
  12 +++ b/include/linux/overflow.h
  13 @@ -0,0 +1,309 @@
  14 +/* SPDX-License-Identifier: GPL-2.0 OR MIT */
  15 +#ifndef __LINUX_OVERFLOW_H
  16 +#define __LINUX_OVERFLOW_H
  17 +
  18 +#include <linux/compiler.h>
  19 +
  20 +/*
  21 + * In the fallback code below, we need to compute the minimum and
  22 + * maximum values representable in a given type. These macros may also
  23 + * be useful elsewhere, so we provide them outside the
  24 + * COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW block.
  25 + *
  26 + * It would seem more obvious to do something like
  27 + *
  28 + * #define type_min(T) (T)(is_signed_type(T) ? (T)1 << (8*sizeof(T)-1) : 0)
  29 + * #define type_max(T) (T)(is_signed_type(T) ? ((T)1 << (8*sizeof(T)-1)) - 1 : ~(T)0)
  30 + *
  31 + * Unfortunately, the middle expressions, strictly speaking, have
  32 + * undefined behaviour, and at least some versions of gcc warn about
  33 + * the type_max expression (but not if -fsanitize=undefined is in
  34 + * effect; in that case, the warning is deferred to runtime...).
  35 + *
  36 + * The slightly excessive casting in type_min is to make sure the
  37 + * macros also produce sensible values for the exotic type _Bool. [The
  38 + * overflow checkers only almost work for _Bool, but that's
  39 + * a-feature-not-a-bug, since people shouldn't be doing arithmetic on
  40 + * _Bools. Besides, the gcc builtins don't allow _Bool* as third
  41 + * argument.]
  42 + *
  43 + * Idea stolen from
  44 + * https://mail-index.netbsd.org/tech-misc/2007/02/05/0000.html -
  45 + * credit to Christian Biere.
  46 + */
  47 +#define is_signed_type(type)       (((type)(-1)) < (type)1)
  48 +#define __type_half_max(type) ((type)1 << (8*sizeof(type) - 1 - is_signed_type(type)))
  49 +#define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T)))
  50 +#define type_min(T) ((T)((T)-type_max(T)-(T)1))
  51 +
  52 +
  53 +#ifdef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW
  54 +/*
  55 + * For simplicity and code hygiene, the fallback code below insists on
  56 + * a, b and *d having the same type (similar to the min() and max()
  57 + * macros), whereas gcc's type-generic overflow checkers accept
  58 + * different types. Hence we don't just make check_add_overflow an
  59 + * alias for __builtin_add_overflow, but add type checks similar to
  60 + * below.
  61 + */
  62 +#define check_add_overflow(a, b, d) ({         \
  63 +       typeof(a) __a = (a);                    \
  64 +       typeof(b) __b = (b);                    \
  65 +       typeof(d) __d = (d);                    \
  66 +       (void) (&__a == &__b);                  \
  67 +       (void) (&__a == __d);                   \
  68 +       __builtin_add_overflow(__a, __b, __d);  \
  69 +})
  70 +
  71 +#define check_sub_overflow(a, b, d) ({         \
  72 +       typeof(a) __a = (a);                    \
  73 +       typeof(b) __b = (b);                    \
  74 +       typeof(d) __d = (d);                    \
  75 +       (void) (&__a == &__b);                  \
  76 +       (void) (&__a == __d);                   \
  77 +       __builtin_sub_overflow(__a, __b, __d);  \
  78 +})
  79 +
  80 +#define check_mul_overflow(a, b, d) ({         \
  81 +       typeof(a) __a = (a);                    \
  82 +       typeof(b) __b = (b);                    \
  83 +       typeof(d) __d = (d);                    \
  84 +       (void) (&__a == &__b);                  \
  85 +       (void) (&__a == __d);                   \
  86 +       __builtin_mul_overflow(__a, __b, __d);  \
  87 +})
  88 +
  89 +#else
  90 +
  91 +
  92 +/* Checking for unsigned overflow is relatively easy without causing UB. */
  93 +#define __unsigned_add_overflow(a, b, d) ({    \
  94 +       typeof(a) __a = (a);                    \
  95 +       typeof(b) __b = (b);                    \
  96 +       typeof(d) __d = (d);                    \
  97 +       (void) (&__a == &__b);                  \
  98 +       (void) (&__a == __d);                   \
  99 +       *__d = __a + __b;                       \
 100 +       *__d < __a;                             \
 101 +})
 102 +#define __unsigned_sub_overflow(a, b, d) ({    \
 103 +       typeof(a) __a = (a);                    \
 104 +       typeof(b) __b = (b);                    \
 105 +       typeof(d) __d = (d);                    \
 106 +       (void) (&__a == &__b);                  \
 107 +       (void) (&__a == __d);                   \
 108 +       *__d = __a - __b;                       \
 109 +       __a < __b;                              \
 110 +})
 111 +/*
 112 + * If one of a or b is a compile-time constant, this avoids a division.
 113 + */
 114 +#define __unsigned_mul_overflow(a, b, d) ({            \
 115 +       typeof(a) __a = (a);                            \
 116 +       typeof(b) __b = (b);                            \
 117 +       typeof(d) __d = (d);                            \
 118 +       (void) (&__a == &__b);                          \
 119 +       (void) (&__a == __d);                           \
 120 +       *__d = __a * __b;                               \
 121 +       __builtin_constant_p(__b) ?                     \
 122 +         __b > 0 && __a > type_max(typeof(__a)) / __b : \
 123 +         __a > 0 && __b > type_max(typeof(__b)) / __a;  \
 124 +})
 125 +
 126 +/*
 127 + * For signed types, detecting overflow is much harder, especially if
 128 + * we want to avoid UB. But the interface of these macros is such that
 129 + * we must provide a result in *d, and in fact we must produce the
 130 + * result promised by gcc's builtins, which is simply the possibly
 131 + * wrapped-around value. Fortunately, we can just formally do the
 132 + * operations in the widest relevant unsigned type (u64) and then
 133 + * truncate the result - gcc is smart enough to generate the same code
 134 + * with and without the (u64) casts.
 135 + */
 136 +
 137 +/*
 138 + * Adding two signed integers can overflow only if they have the same
 139 + * sign, and overflow has happened iff the result has the opposite
 140 + * sign.
 141 + */
 142 +#define __signed_add_overflow(a, b, d) ({      \
 143 +       typeof(a) __a = (a);                    \
 144 +       typeof(b) __b = (b);                    \
 145 +       typeof(d) __d = (d);                    \
 146 +       (void) (&__a == &__b);                  \
 147 +       (void) (&__a == __d);                   \
 148 +       *__d = (u64)__a + (u64)__b;             \
 149 +       (((~(__a ^ __b)) & (*__d ^ __a))        \
 150 +               & type_min(typeof(__a))) != 0;  \
 151 +})
 152 +
 153 +/*
 154 + * Subtraction is similar, except that overflow can now happen only
 155 + * when the signs are opposite. In this case, overflow has happened if
 156 + * the result has the opposite sign of a.
 157 + */
 158 +#define __signed_sub_overflow(a, b, d) ({      \
 159 +       typeof(a) __a = (a);                    \
 160 +       typeof(b) __b = (b);                    \
 161 +       typeof(d) __d = (d);                    \
 162 +       (void) (&__a == &__b);                  \
 163 +       (void) (&__a == __d);                   \
 164 +       *__d = (u64)__a - (u64)__b;             \
 165 +       ((((__a ^ __b)) & (*__d ^ __a))         \
 166 +               & type_min(typeof(__a))) != 0;  \
 167 +})
 168 +
 169 +/*
 170 + * Signed multiplication is rather hard. gcc always follows C99, so
 171 + * division is truncated towards 0. This means that we can write the
 172 + * overflow check like this:
 173 + *
 174 + * (a > 0 && (b > MAX/a || b < MIN/a)) ||
 175 + * (a < -1 && (b > MIN/a || b < MAX/a) ||
 176 + * (a == -1 && b == MIN)
 177 + *
 178 + * The redundant casts of -1 are to silence an annoying -Wtype-limits
 179 + * (included in -Wextra) warning: When the type is u8 or u16, the
 180 + * __b_c_e in check_mul_overflow obviously selects
 181 + * __unsigned_mul_overflow, but unfortunately gcc still parses this
 182 + * code and warns about the limited range of __b.
 183 + */
 184 +
 185 +#define __signed_mul_overflow(a, b, d) ({                              \
 186 +       typeof(a) __a = (a);                                            \
 187 +       typeof(b) __b = (b);                                            \
 188 +       typeof(d) __d = (d);                                            \
 189 +       typeof(a) __tmax = type_max(typeof(a));                         \
 190 +       typeof(a) __tmin = type_min(typeof(a));                         \
 191 +       (void) (&__a == &__b);                                          \
 192 +       (void) (&__a == __d);                                           \
 193 +       *__d = (u64)__a * (u64)__b;                                     \
 194 +       (__b > 0   && (__a > __tmax/__b || __a < __tmin/__b)) ||        \
 195 +       (__b < (typeof(__b))-1  && (__a > __tmin/__b || __a < __tmax/__b)) || \
 196 +       (__b == (typeof(__b))-1 && __a == __tmin);                      \
 197 +})
 198 +
 199 +
 200 +#define check_add_overflow(a, b, d)                                    \
 201 +       __builtin_choose_expr(is_signed_type(typeof(a)),                \
 202 +                       __signed_add_overflow(a, b, d),                 \
 203 +                       __unsigned_add_overflow(a, b, d))
 204 +
 205 +#define check_sub_overflow(a, b, d)                                    \
 206 +       __builtin_choose_expr(is_signed_type(typeof(a)),                \
 207 +                       __signed_sub_overflow(a, b, d),                 \
 208 +                       __unsigned_sub_overflow(a, b, d))
 209 +
 210 +#define check_mul_overflow(a, b, d)                                    \
 211 +       __builtin_choose_expr(is_signed_type(typeof(a)),                \
 212 +                       __signed_mul_overflow(a, b, d),                 \
 213 +                       __unsigned_mul_overflow(a, b, d))
 214 +
 215 +
 216 +#endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */
 217 +
 218 +/** check_shl_overflow() - Calculate a left-shifted value and check overflow
 219 + *
 220 + * @a: Value to be shifted
 221 + * @s: How many bits left to shift
 222 + * @d: Pointer to where to store the result
 223 + *
 224 + * Computes *@d = (@a << @s)
 225 + *
 226 + * Returns true if '*d' cannot hold the result or when 'a << s' doesn't
 227 + * make sense. Example conditions:
 228 + * - 'a << s' causes bits to be lost when stored in *d.
 229 + * - 's' is garbage (e.g. negative) or so large that the result of
 230 + *   'a << s' is guaranteed to be 0.
 231 + * - 'a' is negative.
 232 + * - 'a << s' sets the sign bit, if any, in '*d'.
 233 + *
 234 + * '*d' will hold the results of the attempted shift, but is not
 235 + * considered "safe for use" if false is returned.
 236 + */
 237 +#define check_shl_overflow(a, s, d) ({                                 \
 238 +       typeof(a) _a = a;                                               \
 239 +       typeof(s) _s = s;                                               \
 240 +       typeof(d) _d = d;                                               \
 241 +       u64 _a_full = _a;                                               \
 242 +       unsigned int _to_shift =                                        \
 243 +               _s >= 0 && _s < 8 * sizeof(*d) ? _s : 0;                \
 244 +       *_d = (_a_full << _to_shift);                                   \
 245 +       (_to_shift != _s || *_d < 0 || _a < 0 ||                        \
 246 +               (*_d >> _to_shift) != _a);                              \
 247 +})
 248 +
 249 +/**
 250 + * array_size() - Calculate size of 2-dimensional array.
 251 + *
 252 + * @a: dimension one
 253 + * @b: dimension two
 254 + *
 255 + * Calculates size of 2-dimensional array: @a * @b.
 256 + *
 257 + * Returns: number of bytes needed to represent the array or SIZE_MAX on
 258 + * overflow.
 259 + */
 260 +static inline __must_check size_t array_size(size_t a, size_t b)
 261 +{
 262 +       size_t bytes;
 263 +
 264 +       if (check_mul_overflow(a, b, &bytes))
 265 +               return SIZE_MAX;
 266 +
 267 +       return bytes;
 268 +}
 269 +
 270 +/**
 271 + * array3_size() - Calculate size of 3-dimensional array.
 272 + *
 273 + * @a: dimension one
 274 + * @b: dimension two
 275 + * @c: dimension three
 276 + *
 277 + * Calculates size of 3-dimensional array: @a * @b * @c.
 278 + *
 279 + * Returns: number of bytes needed to represent the array or SIZE_MAX on
 280 + * overflow.
 281 + */
 282 +static inline __must_check size_t array3_size(size_t a, size_t b, size_t c)
 283 +{
 284 +       size_t bytes;
 285 +
 286 +       if (check_mul_overflow(a, b, &bytes))
 287 +               return SIZE_MAX;
 288 +       if (check_mul_overflow(bytes, c, &bytes))
 289 +               return SIZE_MAX;
 290 +
 291 +       return bytes;
 292 +}
 293 +
 294 +static inline __must_check size_t __ab_c_size(size_t n, size_t size, size_t c)
 295 +{
 296 +       size_t bytes;
 297 +
 298 +       if (check_mul_overflow(n, size, &bytes))
 299 +               return SIZE_MAX;
 300 +       if (check_add_overflow(bytes, c, &bytes))
 301 +               return SIZE_MAX;
 302 +
 303 +       return bytes;
 304 +}
 305 +
 306 +/**
 307 + * struct_size() - Calculate size of structure with trailing array.
 308 + * @p: Pointer to the structure.
 309 + * @member: Name of the array member.
 310 + * @n: Number of elements in the array.
 311 + *
 312 + * Calculates size of memory needed for structure @p followed by an
 313 + * array of @n @member elements.
 314 + *
 315 + * Return: number of bytes needed or SIZE_MAX on overflow.
 316 + */
 317 +#define struct_size(p, member, n)                                      \
 318 +       __ab_c_size(n,                                                  \
 319 +                   sizeof(*(p)->member) + __must_be_array((p)->member),\
 320 +                   sizeof(*(p)))
 321 +
 322 +#endif /* __LINUX_OVERFLOW_H */