diff mbox series

[U-Boot,v2,09/13] common.h: Fix signed shift overflow in cpumask_next()

Message ID 20180826231332.2491-10-erosca@de.adit-jv.com
State Superseded
Delegated to: Tom Rini
Headers show
Series Import Undefined Behavior Sanitizer | expand

Commit Message

Eugeniu Rosca Aug. 26, 2018, 11:13 p.m. UTC 
Fix the following UBSAN report:
 =================================================================
 UBSAN: Undefined behaviour in include/common.h:322:19
 left shift of 1 by 31 places cannot be represented in type 'int'
 =================================================================

Steps to reproduce the above:
* echo CONFIG_UBSAN=y >> configs/qemu-ppce500_defconfig
* make ARCH=powerpc CROSS_COMPILE=/usr/bin/powerpc-linux-gnu- \
       qemu-ppce500_defconfig all
* qemu-system-ppc --version
  QEMU emulator version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.31)
* qemu-system-ppc -machine ppce500 -nographic -no-reboot -kernel u-boot

It looks like cpumask_next() intentionally uses shift overflow in its
for loop condition to break the loop. Relying on UB is not safe. Convert
the numeric literal 1 to 1UL and limit its maximum shift index to 31.

Fixes: fbb9ecf7493f ("powerpc/mp: add support for discontiguous cores")
Signed-off-by: Eugeniu Rosca <erosca@de.adit-jv.com>
---

Changes in v2:
 - None. Newly pushed.
---
 include/common.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/include/common.h b/include/common.h
index 940161f1758b..5b92666d0e79 100644
--- a/include/common.h
+++ b/include/common.h
@@ -319,7 +319,7 @@  void	trap_init     (ulong);
 /* $(CPU)/cpu.c */
 static inline int cpumask_next(int cpu, unsigned int mask)
 {
-	for (cpu++; !((1 << cpu) & mask); cpu++)
+	for (cpu++; (cpu < 31) && !((1UL << cpu) & mask); cpu++)
 		;
 
 	return cpu;