NTB: Fix UB/bug in ntb_mw_get_align()
PATCH 1/1 NTB: Fix UB/bug in ntb_mw_get_align()
Simple (1 << pidx) operation causes undefined behaviour when pidx >= 32. It must be casted to u64 to match the actual return value of ntb_link_is_up() method, so to have all the possible peer indexes covered and to get rid of undefined behaviour. Additionally there are special macros in "linux/bitops.h" to perform the bit-set-shift operations, so it's recommended to have them used for proper bit setting.
--- include/linux/ntb.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/ntb.h +1 -1
@@ -764,7 +764,7 @@ static inline int ntb_mw_get_align(struct ntb_dev *ntb, int pidx, int widx, resource_size_t *size_align, resource_size_t *size_max) { -if (!(ntb_link_is_up (ntb,NULL ,NULL ) & (1 << pidx))) +if (!(ntb_link_is_up (ntb,NULL ,NULL ) &BIT_ULL (pidx)))return -ENOTCONN ; return ntb->ops->mw_get_align(ntb, pidx, widx, addr_align, size_align,
Signature · 1 line
2.12.0
Quoted 9 lines · Serge Semin
Simple (1 << pidx) operation causes undefined behaviour when pidx >= 32. It must be casted to u64 to match the actual return value of
ntb_link_is_up()method, so to have all the possible peer indexes covered and to get rid of undefined behaviour. Additionally there are special macros in "linux/bitops.h" to perform the bit-set-shift operations, so it's recommended to have them used for proper bit setting.Signed-off-by Serge Semin <[email protected]>
Quoted 18 lines
--- include/linux/ntb.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)include/linux/ntb.h +1
-1@@ -764,7 +764,7 @@ static inline int ntb_mw_get_align(struct ntb_dev *ntb, int pidx, int widx, resource_size_t *size_align, resource_size_t *size_max) { -if (!(ntb_link_is_up (ntb,NULL ,NULL ) & (1 << pidx))) +if (!(ntb_link_is_up (ntb,NULL ,NULL ) &BIT_ULL (pidx)))return -ENOTCONN ; return ntb->ops->mw_get_align(ntb, pidx, widx, addr_align, size_align,