[U-Boot] [PATCH v2 09/13] common.h: Fix signed shift overflow in cpumask_next()

Eugeniu Rosca roscaeugeniu at gmail.com
Sun Aug 26 23:13:27 UTC 2018


Fix the following UBSAN report:
 =================================================================
 UBSAN: Undefined behaviour in include/common.h:322:19
 left shift of 1 by 31 places cannot be represented in type 'int'
 =================================================================

Steps to reproduce the above:
* echo CONFIG_UBSAN=y >> configs/qemu-ppce500_defconfig
* make ARCH=powerpc CROSS_COMPILE=/usr/bin/powerpc-linux-gnu- \
       qemu-ppce500_defconfig all
* qemu-system-ppc --version
  QEMU emulator version 2.5.0 (Debian 1:2.5+dfsg-5ubuntu10.31)
* qemu-system-ppc -machine ppce500 -nographic -no-reboot -kernel u-boot

It looks like cpumask_next() intentionally uses shift overflow in its
for loop condition to break the loop. Relying on UB is not safe. Convert
the numeric literal 1 to 1UL and limit its maximum shift index to 31.

Fixes: fbb9ecf7493f ("powerpc/mp: add support for discontiguous cores")
Signed-off-by: Eugeniu Rosca <erosca at de.adit-jv.com>
---

Changes in v2:
 - None. Newly pushed.
---
 include/common.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/common.h b/include/common.h
index 940161f1758b..5b92666d0e79 100644
--- a/include/common.h
+++ b/include/common.h
@@ -319,7 +319,7 @@ void	trap_init     (ulong);
 /* $(CPU)/cpu.c */
 static inline int cpumask_next(int cpu, unsigned int mask)
 {
-	for (cpu++; !((1 << cpu) & mask); cpu++)
+	for (cpu++; (cpu < 31) && !((1UL << cpu) & mask); cpu++)
 		;
 
 	return cpu;
-- 
2.18.0



More information about the U-Boot mailing list