overflow: Introduce wrapping_assign_add() and wrapping_assign_sub()

This allows replacements of the idioms "var += offset" and "var -=
offset" with the wrapping_assign_add() and wrapping_assign_sub() helpers
respectively. They will avoid wrap-around sanitizer instrumentation.

Add to the selftests to validate behavior and lack of side-effects.

Reviewed-by: Marco Elver <elver@google.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Kees Cook <keescook@chromium.org>

diff --git a/include/linux/overflow.h b/include/linux/overflow.h
index d3ff8e2bec2972b68249197ffeabb4e7f0bae522..dede374832c9b992e5c48eac73f2bb82a40a300e 100644 (file)
--- a/include/linux/overflow.h
+++ b/include/linux/overflow.h
@@ -81,6 +81,22 @@ static inline bool __must_check __must_check_overflow(bool overflow)
                __val;                                          \
        })
 
+/**
+ * wrapping_assign_add() - Intentionally perform a wrapping increment assignment
+ * @var: variable to be incremented
+ * @offset: amount to add
+ *
+ * Increments @var by @offset with wrap-around. Returns the resulting
+ * value of @var. Will not trip any wrap-around sanitizers.
+ *
+ * Returns the new value of @var.
+ */
+#define wrapping_assign_add(var, offset)                               \
+       ({                                                              \
+               typeof(var) *__ptr = &(var);                            \
+               *__ptr = wrapping_add(typeof(var), *__ptr, offset);     \
+       })
+
 /**
  * check_sub_overflow() - Calculate subtraction with overflow checking
  * @a: minuend; value to subtract from
@@ -111,6 +127,22 @@ static inline bool __must_check __must_check_overflow(bool overflow)
                __val;                                          \
        })
 
+/**
+ * wrapping_assign_sub() - Intentionally perform a wrapping decrement assign
+ * @var: variable to be decremented
+ * @offset: amount to subtract
+ *
+ * Decrements @var by @offset with wrap-around. Returns the resulting
+ * value of @var. Will not trip any wrap-around sanitizers.
+ *
+ * Returns the new value of @var.
+ */
+#define wrapping_assign_sub(var, offset)                               \
+       ({                                                              \
+               typeof(var) *__ptr = &(var);                            \
+               *__ptr = wrapping_sub(typeof(var), *__ptr, offset);     \
+       })
+
 /**
  * check_mul_overflow() - Calculate multiplication with overflow checking
  * @a: first factor

diff --git a/lib/overflow_kunit.c b/lib/overflow_kunit.c
index d3fdb906d3fef7e2022830a4d3d61ee422186fbe..65e8a72a83bfaa9ccfd2c47b0290eedfa46520d3 100644 (file)
--- a/lib/overflow_kunit.c
+++ b/lib/overflow_kunit.c
@@ -284,6 +284,45 @@ DEFINE_TEST_ARRAY(s64) = {
                "Unexpected wrap " #op " macro side-effect!\n");        \
 } while (0)
 
+static int global_counter;
+static void bump_counter(void)
+{
+       global_counter++;
+}
+
+static int get_index(void)
+{
+       volatile int index = 0;
+       bump_counter();
+       return index;
+}
+
+#define check_self_op(fmt, op, sym, a, b) do {                         \
+       typeof(a + 0) _a = a;                                           \
+       typeof(b + 0) _b = b;                                           \
+       typeof(a + 0) _a_sym = a;                                       \
+       typeof(a + 0) _a_orig[1] = { a };                               \
+       typeof(b + 0) _b_orig = b;                                      \
+       typeof(b + 0) _b_bump = b + 1;                                  \
+       typeof(a + 0) _r;                                               \
+                                                                       \
+       _a_sym sym _b;                                                  \
+       _r = wrapping_ ## op(_a, _b);                                   \
+       KUNIT_EXPECT_TRUE_MSG(test, _r == _a_sym,                       \
+               "expected "fmt" "#op" "fmt" == "fmt", got "fmt"\n",     \
+               a, b, _a_sym, _r);                                      \
+       KUNIT_EXPECT_TRUE_MSG(test, _a == _a_sym,                       \
+               "expected "fmt" "#op" "fmt" == "fmt", got "fmt"\n",     \
+               a, b, _a_sym, _a);                                      \
+       /* Check for internal macro side-effects. */                    \
+       global_counter = 0;                                             \
+       wrapping_ ## op(_a_orig[get_index()], _b_orig++);               \
+       KUNIT_EXPECT_EQ_MSG(test, global_counter, 1,                    \
+               "Unexpected wrapping_" #op " macro side-effect on arg1!\n"); \
+       KUNIT_EXPECT_EQ_MSG(test, _b_orig, _b_bump,                     \
+               "Unexpected wrapping_" #op " macro side-effect on arg2!\n"); \
+} while (0)
+
 #define DEFINE_TEST_FUNC_TYPED(n, t, fmt)                              \
 static void do_test_ ## n(struct kunit *test, const struct test_ ## n *p) \
 {                                                                      \
@@ -293,6 +332,10 @@ static void do_test_ ## n(struct kunit *test, const struct test_ ## n *p) \
        check_one_op(t, fmt, sub, "-", p->a, p->b, p->diff, p->d_of);   \
        check_one_op(t, fmt, mul, "*", p->a, p->b, p->prod, p->p_of);   \
        check_one_op(t, fmt, mul, "*", p->b, p->a, p->prod, p->p_of);   \
+       /* wrapping_assign_{add,sub}() */                               \
+       check_self_op(fmt, assign_add, +=, p->a, p->b);                 \
+       check_self_op(fmt, assign_add, +=, p->b, p->a);                 \
+       check_self_op(fmt, assign_sub, -=, p->a, p->b);                 \
 }                                                                      \
                                                                        \
 static void n ## _overflow_test(struct kunit *test) {                  \