patches.lists.linux.dev archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Helge Deller <deller@gmx.de>,
	Chanho Min <chanho.min@lge.com>,
	Geert Uytterhoeven <geert@linux-m68k.org>,
	Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 4.14 51/57] lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
Date: Mon, 28 Aug 2023 12:13:11 +0200	[thread overview]
Message-ID: <20230828101146.148941596@linuxfoundation.org> (raw)
In-Reply-To: <20230828101144.231099710@linuxfoundation.org>

4.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Helge Deller <deller@gmx.de>

commit 382d4cd1847517ffcb1800fd462b625db7b2ebea upstream.

The gcc compiler translates on some architectures the 64-bit
__builtin_clzll() function to a call to the libgcc function __clzdi2(),
which should take a 64-bit parameter on 32- and 64-bit platforms.

But in the current kernel code, the built-in __clzdi2() function is
defined to operate (wrongly) on 32-bit parameters if BITS_PER_LONG ==
32, thus the return values on 32-bit kernels are in the range from
[0..31] instead of the expected [0..63] range.

This patch fixes the in-kernel functions __clzdi2() and __ctzdi2() to
take a 64-bit parameter on 32-bit kernels as well, thus it makes the
functions identical for 32- and 64-bit kernels.

This bug went unnoticed since kernel 3.11 for over 10 years, and here
are some possible reasons for that:

 a) Some architectures have assembly instructions to count the bits and
    which are used instead of calling __clzdi2(), e.g. on x86 the bsr
    instruction and on ppc cntlz is used. On such architectures the
    wrong __clzdi2() implementation isn't used and as such the bug has
    no effect and won't be noticed.

 b) Some architectures link to libgcc.a, and the in-kernel weak
    functions get replaced by the correct 64-bit variants from libgcc.a.

 c) __builtin_clzll() and __clzdi2() doesn't seem to be used in many
    places in the kernel, and most likely only in uncritical functions,
    e.g. when printing hex values via seq_put_hex_ll(). The wrong return
    value will still print the correct number, but just in a wrong
    formatting (e.g. with too many leading zeroes).

 d) 32-bit kernels aren't used that much any longer, so they are less
    tested.

A trivial testcase to verify if the currently running 32-bit kernel is
affected by the bug is to look at the output of /proc/self/maps:

Here the kernel uses a correct implementation of __clzdi2():

  root@debian:~# cat /proc/self/maps
  00010000-00019000 r-xp 00000000 08:05 787324     /usr/bin/cat
  00019000-0001a000 rwxp 00009000 08:05 787324     /usr/bin/cat
  0001a000-0003b000 rwxp 00000000 00:00 0          [heap]
  f7551000-f770d000 r-xp 00000000 08:05 794765     /usr/lib/hppa-linux-gnu/libc.so.6
  ...

and this kernel uses the broken implementation of __clzdi2():

  root@debian:~# cat /proc/self/maps
  0000000010000-0000000019000 r-xp 00000000 000000008:000000005 787324  /usr/bin/cat
  0000000019000-000000001a000 rwxp 000000009000 000000008:000000005 787324  /usr/bin/cat
  000000001a000-000000003b000 rwxp 00000000 00:00 0  [heap]
  00000000f73d1000-00000000f758d000 r-xp 00000000 000000008:000000005 794765  /usr/lib/hppa-linux-gnu/libc.so.6
  ...

Signed-off-by: Helge Deller <deller@gmx.de>
Fixes: 4df87bb7b6a22 ("lib: add weak clz/ctz functions")
Cc: Chanho Min <chanho.min@lge.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: stable@vger.kernel.org # v3.11+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/clz_ctz.c |   32 ++++++--------------------------
 1 file changed, 6 insertions(+), 26 deletions(-)

--- a/lib/clz_ctz.c
+++ b/lib/clz_ctz.c
@@ -30,36 +30,16 @@ int __weak __clzsi2(int val)
 }
 EXPORT_SYMBOL(__clzsi2);
 
-int __weak __clzdi2(long val);
-int __weak __ctzdi2(long val);
-#if BITS_PER_LONG == 32
-
-int __weak __clzdi2(long val)
+int __weak __clzdi2(u64 val);
+int __weak __clzdi2(u64 val)
 {
-	return 32 - fls((int)val);
+	return 64 - fls64(val);
 }
 EXPORT_SYMBOL(__clzdi2);
 
-int __weak __ctzdi2(long val)
+int __weak __ctzdi2(u64 val);
+int __weak __ctzdi2(u64 val)
 {
-	return __ffs((u32)val);
+	return __ffs64(val);
 }
 EXPORT_SYMBOL(__ctzdi2);
-
-#elif BITS_PER_LONG == 64
-
-int __weak __clzdi2(long val)
-{
-	return 64 - fls64((u64)val);
-}
-EXPORT_SYMBOL(__clzdi2);
-
-int __weak __ctzdi2(long val)
-{
-	return __ffs64((u64)val);
-}
-EXPORT_SYMBOL(__ctzdi2);
-
-#else
-#error BITS_PER_LONG not 32 or 64
-#endif



  parent reply	other threads:[~2023-08-28 10:16 UTC|newest]

Thread overview: 65+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-08-28 10:12 [PATCH 4.14 00/57] 4.14.324-rc1 review Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 01/57] lib/mpi: Eliminate unused umul_ppmm definitions for MIPS Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 02/57] drm/radeon: Fix integer overflow in radeon_cs_parser_init Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 03/57] ALSA: emu10k1: roll up loops in DSP setup code for Audigy Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 04/57] quota: Properly disable quotas when add_dquot_ref() fails Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 05/57] quota: fix warning in dqgrab() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 06/57] udf: Fix uninitialized array access for some pathnames Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 07/57] fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 08/57] MIPS: dec: prom: Address -Warray-bounds warning Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 09/57] FS: JFS: Fix null-ptr-deref Read in txBegin Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 10/57] FS: JFS: Check for read-only mounted filesystem " Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 11/57] media: v4l2-mem2mem: add lock to protect parameter num_rdy Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 12/57] media: platform: mediatek: vpu: fix NULL ptr dereference Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 13/57] gfs2: Fix possible data races in gfs2_show_options() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 14/57] pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 15/57] Bluetooth: L2CAP: Fix use-after-free Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 16/57] drm/amdgpu: Fix potential fence use-after-free v2 Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 17/57] fbdev: mmp: fix value check in mmphw_probe() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 18/57] powerpc/rtas_flash: allow user copy to flash block cache objects Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 19/57] net: xfrm: Fix xfrm_address_filter OOB read Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 20/57] net: af_key: fix sadb_x_filter validation Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 21/57] ip6_vti: fix slab-use-after-free in decode_session6 Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 22/57] ip_vti: fix potential " Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 23/57] xfrm: add NULL check in xfrm_update_ae_params Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 24/57] netfilter: nft_dynset: disallow object maps Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 25/57] team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 26/57] i40e: fix misleading debug logs Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 27/57] sock: Fix misuse of sk_under_memory_pressure() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 28/57] net: do not allow gso_size to be set to GSO_BY_FRAGS Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 29/57] ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 30/57] cifs: Release folio lock on fscache read hit Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 31/57] mmc: wbsd: fix double mmc_free_host() in wbsd_init() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 32/57] serial: 8250: Fix oops for port->pm on uart_change_pm() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 33/57] binder: fix memory leak in binder_init() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 34/57] test_firmware: prevent race conditions by a correct implementation of locking Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 35/57] netfilter: set default timeout to 3 secs for sctp shutdown send and recv state Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 36/57] ASoC: rt5665: add missed regulator_bulk_disable Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 37/57] af_unix: Fix null-ptr-deref in unix_stream_sendpage() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 38/57] net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 39/57] net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 40/57] net: phy: broadcom: stub c45 read/write for 54810 Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 41/57] tracing: Fix memleak due to race between current_tracer and trace Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 42/57] sock: annotate data-races around prot->memory_pressure Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 43/57] igb: Avoid starting unnecessary workqueues Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 44/57] ipvs: Improve robustness to the ipvs sysctl Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 45/57] ipvs: fix racy memcpy in proc_do_sync_threshold Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 46/57] ibmveth: Use dcbf rather than dcbfl Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 47/57] batman-adv: Trigger events for auto adjusted MTU Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 48/57] batman-adv: Do not get eth header before batadv_check_management_packet Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 49/57] batman-adv: Fix TT global entry leak when client roamed back Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 50/57] batman-adv: Fix batadv_v_ogm_aggr_send memory leak Greg Kroah-Hartman
2023-08-28 10:13 ` Greg Kroah-Hartman [this message]
2023-08-28 10:13 ` [PATCH 4.14 52/57] media: vcodec: Fix potential array out-of-bounds in encoder queue_setup Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 53/57] x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 54/57] rtnetlink: Reject negative ifindexes in RTM_NEWLINK Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 55/57] scsi: snic: Fix double free in snic_tgt_create() Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 56/57] scsi: core: raid_class: Remove raid_component_add() Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 57/57] dma-buf/sw_sync: Avoid recursive lock during fence signal Greg Kroah-Hartman
2023-08-29  3:01 ` [PATCH 4.14 00/57] 4.14.324-rc1 review Daniel Díaz
2023-08-29 11:57   ` Nathan Lynch
2023-08-30 12:32   ` Greg Kroah-Hartman
2023-08-30  1:56 ` Guenter Roeck
2023-08-30 12:33   ` Greg Kroah-Hartman
2023-08-30 10:24 ` Jon Hunter
2023-08-30 11:31 ` Pavel Machek

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230828101146.148941596@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=chanho.min@lge.com \
    --cc=deller@gmx.de \
    --cc=geert@linux-m68k.org \
    --cc=patches@lists.linux.dev \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).