From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C3107CCF9E9 for ; Sat, 18 Oct 2025 08:51:16 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 6D14C10ECFC; Sat, 18 Oct 2025 08:50:59 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="iGUYOZ0c"; dkim-atps=neutral Received: from sea.source.kernel.org (sea.source.kernel.org [172.234.252.31]) by gabe.freedesktop.org (Postfix) with ESMTPS id 6BE3A10EC50; Fri, 17 Oct 2025 13:48:42 +0000 (UTC) Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 41AC4408CD; Fri, 17 Oct 2025 13:48:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7136C19422; Fri, 17 Oct 2025 13:48:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1760708922; bh=tgzAnA2OkjLe7htmZ7GtzRbBBQ/ZgR6eYFTdikkqqg0=; h=Subject:To:Cc:From:Date:In-Reply-To:From; b=iGUYOZ0cHe2PutTEbIruDm2iopRb/fs6f5Gpyi63EqmMzO9ZGK6qAhJUExLl0GmvX JiHKgUJJ4A74VVhDyYkqnfXyjrQagNYuVS+sD15S5vrB58bZmtXhZNOc9jM3PgMZHf JOMNhgJZKz0/fhRMiIpBvOi0ErW3haguI/7b0Iz8= Subject: Patch "minmax: allow min()/max()/clamp() if the arguments have the same signedness." has been added to the 5.10-stable tree To: David.Laight@ACULAB.COM, Jason@zx2c4.com, adilger.kernel@dilger.ca, agk@redhat.com, airlied@linux.ie, akpm@linux-foundation.org, alexander.deucher@amd.com, alexandre.torgue@st.com, amd-gfx@lists.freedesktop.org, andriy.shevchenko@linux.intel.com, anton.ivanov@cambridgegreys.com, artur.paszkiewicz@intel.com, bp@alien8.de, brian.starkey@arm.com, bvanassche@acm.org, chao@kernel.org, christian.koenig@amd.com, clm@fb.com, coreteam@netfilter.org, daniel@ffwll.ch, dave.hansen@linux.intel.com, davem@davemloft.net, david.laight@aculab.com, dm-devel@redhat.com, dmitry.torokhov@gmail.com, dri-devel@lists.freedesktop.org, dsterba@suse.com, dushistov@mail.ru, evan.quan@amd.com, farbere@amazon.com, fery@cypress.com, freedreno@lists.freedesktop.org, fw@strlen.de, gregkh@linuxfoundation.org, harry.wentland@amd.com, hch@infradead.org, hdegoede@redhat.com, herve.codina@bootlin.com, hpa@zytor.com, intel-linux-scu@intel.com, jack@suse.com, james.morse@arm.com, james.qian.wang@arm.com, jdelvare@suse.com, jdike@addtoit.com, jejb@linux.ibm.com, jm@freedesktop.org, aloy@redhat.com, joabreu@synopsys.com, josef@toxicpanda.com, kadlec@netfilter.org, kbusch@kernel.org, keescook@chromium.org, kuba@kernel.org, kuznet@ms2.inr.ac.ru, linux-arm-kernel@lists.infradead.org, linux-erofs@lists.ozlabs.org, linux-mm@kvack.org, linux-staging@lists.linux.dev, linux-stm32@st-md-mailman.stormreply.com, linux-um@lists.infradead.org, linux@armlinux.org.uk, linux@rasmusvillemoes.dk, linux@roeck-us.net, liviu.dudau@arm.com, luc.vanoostenryck@gmail.com, luto@kernel.org, maarten.lankhorst@linux.intel.com, malattia@linux.it, martin.petersen@oracle.com, mchehab@kernel.org, mcoquelin.stm32@gmail.com, mgross@linux.intel.com, mihail.atanassov@arm.com, minchan@kernel.org, mingo@redhat.com, mripard@kernel.org, nathan@kernel.org, ndesaulniers@google.com, ngupta@vflare.org, pablo@netfilter.org, peppe.cavallaro@st.com, peterz@infradead.org, pmladek@suse.com, qiuxu.zhuo@intel.com, rajur@chelsio.com, richard@nod.at, robdclark@gmail.com, rostedt@goodmis.org, rric@kernel.org, ruanjinjie@huawei.com, sakari.ailus@linux.intel.c, om@freedesktop.org, sashal@kernel.org, sean@poorly.run, sergey.senozhatsky@gmail.com, snitzer@redhat.com, sunpeng.li@amd.com, tglx@linutronix.de, tipc-discussion@lists.sourceforge.net, tony.luck@intel.com, torvalds@linux-foundation.org, tytso@mit.edu, tzimmermann@suse.de, willy@infradead.org, x86@kernel.org, xiang@kernel.org, ying.xue@windriver.com, yoshfuji@linux-ipv6.org Cc: From: Date: Fri, 17 Oct 2025 15:48:28 +0200 In-Reply-To: <20251017090519.46992-10-farbere@amazon.com> Message-ID: <2025101728-math-crafter-245a@gregkh> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit X-stable: commit X-Patchwork-Hint: ignore X-Mailman-Approved-At: Sat, 18 Oct 2025 08:50:54 +0000 X-BeenThere: amd-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion list for AMD gfx List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: amd-gfx-bounces@lists.freedesktop.org Sender: "amd-gfx" This is a note to let you know that I've just added the patch titled minmax: allow min()/max()/clamp() if the arguments have the same signedness. to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: minmax-allow-min-max-clamp-if-the-arguments-have-the-same-signedness.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >From prvs=378230090=farbere@amazon.com Fri Oct 17 11:08:35 2025 From: Eliav Farber Date: Fri, 17 Oct 2025 09:05:01 +0000 Subject: minmax: allow min()/max()/clamp() if the arguments have the same signedness. To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Cc: Christoph Hellwig , Linus Torvalds Message-ID: <20251017090519.46992-10-farbere@amazon.com> From: David Laight [ Upstream commit d03eba99f5bf7cbc6e2fdde3b6fa36954ad58e09 ] The type-check in min()/max() is there to stop unexpected results if a negative value gets converted to a large unsigned value. However it also rejects 'unsigned int' v 'unsigned long' compares which are common and never problematc. Replace the 'same type' check with a 'same signedness' check. The new test isn't itself a compile time error, so use static_assert() to report the error and give a meaningful error message. Due to the way builtin_choose_expr() works detecting the error in the 'non-constant' side (where static_assert() can be used) also detects errors when the arguments are constant. Link: https://lkml.kernel.org/r/fe7e6c542e094bfca655abcd323c1c98@AcuMS.aculab.com Signed-off-by: David Laight Cc: Andy Shevchenko Cc: Christoph Hellwig Cc: Jason A. Donenfeld Cc: Linus Torvalds Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton Signed-off-by: Eliav Farber Signed-off-by: Greg Kroah-Hartman --- include/linux/minmax.h | 62 ++++++++++++++++++++++++++----------------------- 1 file changed, 33 insertions(+), 29 deletions(-) --- a/include/linux/minmax.h +++ b/include/linux/minmax.h @@ -12,9 +12,8 @@ * * - avoid multiple evaluations of the arguments (so side-effects like * "x++" happen only once) when non-constant. - * - perform strict type-checking (to generate warnings instead of - * nasty runtime surprises). See the "unnecessary" pointer comparison - * in __typecheck(). + * - perform signed v unsigned type-checking (to generate compile + * errors instead of nasty runtime surprises). * - retain result as a constant expressions when called with only * constant expressions (to avoid tripping VLA warnings in stack * allocation usage). @@ -22,23 +21,30 @@ #define __typecheck(x, y) \ (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) -#define __no_side_effects(x, y) \ - (__is_constexpr(x) && __is_constexpr(y)) +/* is_signed_type() isn't a constexpr for pointer types */ +#define __is_signed(x) \ + __builtin_choose_expr(__is_constexpr(is_signed_type(typeof(x))), \ + is_signed_type(typeof(x)), 0) -#define __safe_cmp(x, y) \ - (__typecheck(x, y) && __no_side_effects(x, y)) +#define __types_ok(x, y) \ + (__is_signed(x) == __is_signed(y)) -#define __cmp(x, y, op) ((x) op (y) ? (x) : (y)) +#define __cmp_op_min < +#define __cmp_op_max > -#define __cmp_once(x, y, unique_x, unique_y, op) ({ \ +#define __cmp(op, x, y) ((x) __cmp_op_##op (y) ? (x) : (y)) + +#define __cmp_once(op, x, y, unique_x, unique_y) ({ \ typeof(x) unique_x = (x); \ typeof(y) unique_y = (y); \ - __cmp(unique_x, unique_y, op); }) - -#define __careful_cmp(x, y, op) \ - __builtin_choose_expr(__safe_cmp(x, y), \ - __cmp(x, y, op), \ - __cmp_once(x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y), op)) + static_assert(__types_ok(x, y), \ + #op "(" #x ", " #y ") signedness error, fix types or consider u" #op "() before " #op "_t()"); \ + __cmp(op, unique_x, unique_y); }) + +#define __careful_cmp(op, x, y) \ + __builtin_choose_expr(__is_constexpr((x) - (y)), \ + __cmp(op, x, y), \ + __cmp_once(op, x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y))) #define __clamp(val, lo, hi) \ ((val) >= (hi) ? (hi) : ((val) <= (lo) ? (lo) : (val))) @@ -47,17 +53,15 @@ typeof(val) unique_val = (val); \ typeof(lo) unique_lo = (lo); \ typeof(hi) unique_hi = (hi); \ + static_assert(__builtin_choose_expr(__is_constexpr((lo) > (hi)), \ + (lo) <= (hi), true), \ + "clamp() low limit " #lo " greater than high limit " #hi); \ + static_assert(__types_ok(val, lo), "clamp() 'lo' signedness error"); \ + static_assert(__types_ok(val, hi), "clamp() 'hi' signedness error"); \ __clamp(unique_val, unique_lo, unique_hi); }) -#define __clamp_input_check(lo, hi) \ - (BUILD_BUG_ON_ZERO(__builtin_choose_expr( \ - __is_constexpr((lo) > (hi)), (lo) > (hi), false))) - #define __careful_clamp(val, lo, hi) ({ \ - __clamp_input_check(lo, hi) + \ - __builtin_choose_expr(__typecheck(val, lo) && __typecheck(val, hi) && \ - __typecheck(hi, lo) && __is_constexpr(val) && \ - __is_constexpr(lo) && __is_constexpr(hi), \ + __builtin_choose_expr(__is_constexpr((val) - (lo) + (hi)), \ __clamp(val, lo, hi), \ __clamp_once(val, lo, hi, __UNIQUE_ID(__val), \ __UNIQUE_ID(__lo), __UNIQUE_ID(__hi))); }) @@ -67,14 +71,14 @@ * @x: first value * @y: second value */ -#define min(x, y) __careful_cmp(x, y, <) +#define min(x, y) __careful_cmp(min, x, y) /** * max - return maximum of two values of the same or compatible types * @x: first value * @y: second value */ -#define max(x, y) __careful_cmp(x, y, >) +#define max(x, y) __careful_cmp(max, x, y) /** * umin - return minimum of two non-negative values @@ -83,7 +87,7 @@ * @y: second value */ #define umin(x, y) \ - __careful_cmp((x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull, <) + __careful_cmp(min, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull) /** * umax - return maximum of two non-negative values @@ -91,7 +95,7 @@ * @y: second value */ #define umax(x, y) \ - __careful_cmp((x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull, >) + __careful_cmp(max, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull) /** * min3 - return minimum of three values @@ -143,7 +147,7 @@ * @x: first value * @y: second value */ -#define min_t(type, x, y) __careful_cmp((type)(x), (type)(y), <) +#define min_t(type, x, y) __careful_cmp(min, (type)(x), (type)(y)) /** * max_t - return maximum of two values, using the specified type @@ -151,7 +155,7 @@ * @x: first value * @y: second value */ -#define max_t(type, x, y) __careful_cmp((type)(x), (type)(y), >) +#define max_t(type, x, y) __careful_cmp(max, (type)(x), (type)(y)) /* * Do not check the array parameter using __must_be_array(). Patches currently in stable-queue which might be from farbere@amazon.com are queue-5.10/minmax-allow-comparisons-of-int-against-unsigned-char-short.patch queue-5.10/minmax-add-a-few-more-min_t-max_t-users.patch queue-5.10/minmax-improve-macro-expansion-and-type-checking.patch queue-5.10/minmax-fix-indentation-of-__cmp_once-and-__clamp_once.patch queue-5.10/minmax.h-simplify-the-variants-of-clamp.patch queue-5.10/minmax-add-in_range-macro.patch queue-5.10/minmax.h-move-all-the-clamp-definitions-after-the-min-max-ones.patch queue-5.10/minmax-allow-min-max-clamp-if-the-arguments-have-the-same-signedness.patch queue-5.10/minmax-don-t-use-max-in-situations-that-want-a-c-constant-expression.patch queue-5.10/minmax.h-remove-some-defines-that-are-only-expanded-once.patch queue-5.10/minmax.h-use-build_bug_on_msg-for-the-lo-hi-test-in-clamp.patch queue-5.10/minmax-simplify-min-max-clamp-implementation.patch queue-5.10/minmax-deduplicate-__unconst_integer_typeof.patch queue-5.10/minmax-simplify-and-clarify-min_t-max_t-implementation.patch queue-5.10/minmax.h-add-whitespace-around-operators-and-after-commas.patch queue-5.10/minmax-sanity-check-constant-bounds-when-clamping.patch queue-5.10/minmax-avoid-overly-complicated-constant-expressions-in-vm-code.patch queue-5.10/minmax-make-generic-min-and-max-macros-available-everywhere.patch queue-5.10/minmax-fix-up-min3-and-max3-too.patch queue-5.10/minmax.h-reduce-the-define-expansion-of-min-max-and-clamp.patch queue-5.10/minmax-fix-header-inclusions.patch queue-5.10/minmax-introduce-min-max-_array.patch queue-5.10/btrfs-remove-duplicated-in_range-macro.patch queue-5.10/overflow-tracing-define-the-is_signed_type-macro-once.patch queue-5.10/minmax-relax-check-to-allow-comparison-between-unsigned-arguments-and-signed-constants.patch queue-5.10/minmax-clamp-more-efficiently-by-avoiding-extra-comparison.patch queue-5.10/minmax.h-update-some-comments.patch