Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0c668477 authored by Jason Gunthorpe's avatar Jason Gunthorpe
Browse files

overflow.h: Add arithmetic shift helper 



Add shift_overflow() helper to assist driver authors in ensuring that
shift operations don't cause overflows or other odd conditions.

Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
[kees: tweaked comments and commit log, dropped unneeded assignment]
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 58796e67

include/linux/overflow.h

+31 −0
Original line number Diff line number Diff line
@@ -202,6 +202,37 @@ 


#endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */



/** check_shl_overflow() - Calculate a left-shifted value and check overflow

 *

 * @a: Value to be shifted

 * @s: How many bits left to shift

 * @d: Pointer to where to store the result

 *

 * Computes *@d = (@a << @s)

 *

 * Returns true if '*d' cannot hold the result or when 'a << s' doesn't

 * make sense. Example conditions:

 * - 'a << s' causes bits to be lost when stored in *d.

 * - 's' is garbage (e.g. negative) or so large that the result of

 *   'a << s' is guaranteed to be 0.

 * - 'a' is negative.

 * - 'a << s' sets the sign bit, if any, in '*d'.

 *

 * '*d' will hold the results of the attempted shift, but is not

 * considered "safe for use" if false is returned.

 */

#define check_shl_overflow(a, s, d) ({					\

	typeof(a) _a = a;						\

	typeof(s) _s = s;						\

	typeof(d) _d = d;						\

	u64 _a_full = _a;						\

	unsigned int _to_shift =					\

		_s >= 0 && _s < 8 * sizeof(*d) ? _s : 0;		\

	*_d = (_a_full << _to_shift);					\

	(_to_shift != _s || *_d < 0 || _a < 0 ||			\

		(*_d >> _to_shift) != _a);				\

})



/**

 * array_size() - Calculate size of 2-dimensional array.

 *