1
2#ifndef __LINUX_OVERFLOW_H
3#define __LINUX_OVERFLOW_H
4
5#include <linux/compiler.h>
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34#define is_signed_type(type) (((type)(-1)) < (type)1)
35#define __type_half_max(type) ((type)1 << (8*sizeof(type) - 1 - is_signed_type(type)))
36#define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T)))
37#define type_min(T) ((T)((T)-type_max(T)-(T)1))
38
39
40#ifdef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW
41
42
43
44
45
46
47
48
49#define check_add_overflow(a, b, d) ({ \
50 typeof(a) __a = (a); \
51 typeof(b) __b = (b); \
52 typeof(d) __d = (d); \
53 (void) (&__a == &__b); \
54 (void) (&__a == __d); \
55 __builtin_add_overflow(__a, __b, __d); \
56})
57
58#define check_sub_overflow(a, b, d) ({ \
59 typeof(a) __a = (a); \
60 typeof(b) __b = (b); \
61 typeof(d) __d = (d); \
62 (void) (&__a == &__b); \
63 (void) (&__a == __d); \
64 __builtin_sub_overflow(__a, __b, __d); \
65})
66
67#define check_mul_overflow(a, b, d) ({ \
68 typeof(a) __a = (a); \
69 typeof(b) __b = (b); \
70 typeof(d) __d = (d); \
71 (void) (&__a == &__b); \
72 (void) (&__a == __d); \
73 __builtin_mul_overflow(__a, __b, __d); \
74})
75
76#else
77
78
79
80#define __unsigned_add_overflow(a, b, d) ({ \
81 typeof(a) __a = (a); \
82 typeof(b) __b = (b); \
83 typeof(d) __d = (d); \
84 (void) (&__a == &__b); \
85 (void) (&__a == __d); \
86 *__d = __a + __b; \
87 *__d < __a; \
88})
89#define __unsigned_sub_overflow(a, b, d) ({ \
90 typeof(a) __a = (a); \
91 typeof(b) __b = (b); \
92 typeof(d) __d = (d); \
93 (void) (&__a == &__b); \
94 (void) (&__a == __d); \
95 *__d = __a - __b; \
96 __a < __b; \
97})
98
99
100
101#define __unsigned_mul_overflow(a, b, d) ({ \
102 typeof(a) __a = (a); \
103 typeof(b) __b = (b); \
104 typeof(d) __d = (d); \
105 (void) (&__a == &__b); \
106 (void) (&__a == __d); \
107 *__d = __a * __b; \
108 __builtin_constant_p(__b) ? \
109 __b > 0 && __a > type_max(typeof(__a)) / __b : \
110 __a > 0 && __b > type_max(typeof(__b)) / __a; \
111})
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129#define __signed_add_overflow(a, b, d) ({ \
130 typeof(a) __a = (a); \
131 typeof(b) __b = (b); \
132 typeof(d) __d = (d); \
133 (void) (&__a == &__b); \
134 (void) (&__a == __d); \
135 *__d = (u64)__a + (u64)__b; \
136 (((~(__a ^ __b)) & (*__d ^ __a)) \
137 & type_min(typeof(__a))) != 0; \
138})
139
140
141
142
143
144
145#define __signed_sub_overflow(a, b, d) ({ \
146 typeof(a) __a = (a); \
147 typeof(b) __b = (b); \
148 typeof(d) __d = (d); \
149 (void) (&__a == &__b); \
150 (void) (&__a == __d); \
151 *__d = (u64)__a - (u64)__b; \
152 ((((__a ^ __b)) & (*__d ^ __a)) \
153 & type_min(typeof(__a))) != 0; \
154})
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172#define __signed_mul_overflow(a, b, d) ({ \
173 typeof(a) __a = (a); \
174 typeof(b) __b = (b); \
175 typeof(d) __d = (d); \
176 typeof(a) __tmax = type_max(typeof(a)); \
177 typeof(a) __tmin = type_min(typeof(a)); \
178 (void) (&__a == &__b); \
179 (void) (&__a == __d); \
180 *__d = (u64)__a * (u64)__b; \
181 (__b > 0 && (__a > __tmax/__b || __a < __tmin/__b)) || \
182 (__b < (typeof(__b))-1 && (__a > __tmin/__b || __a < __tmax/__b)) || \
183 (__b == (typeof(__b))-1 && __a == __tmin); \
184})
185
186
187#define check_add_overflow(a, b, d) \
188 __builtin_choose_expr(is_signed_type(typeof(a)), \
189 __signed_add_overflow(a, b, d), \
190 __unsigned_add_overflow(a, b, d))
191
192#define check_sub_overflow(a, b, d) \
193 __builtin_choose_expr(is_signed_type(typeof(a)), \
194 __signed_sub_overflow(a, b, d), \
195 __unsigned_sub_overflow(a, b, d))
196
197#define check_mul_overflow(a, b, d) \
198 __builtin_choose_expr(is_signed_type(typeof(a)), \
199 __signed_mul_overflow(a, b, d), \
200 __unsigned_mul_overflow(a, b, d))
201
202
203#endif
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224#define check_shl_overflow(a, s, d) ({ \
225 typeof(a) _a = a; \
226 typeof(s) _s = s; \
227 typeof(d) _d = d; \
228 u64 _a_full = _a; \
229 unsigned int _to_shift = \
230 _s >= 0 && _s < 8 * sizeof(*d) ? _s : 0; \
231 *_d = (_a_full << _to_shift); \
232 (_to_shift != _s || *_d < 0 || _a < 0 || \
233 (*_d >> _to_shift) != _a); \
234})
235
236
237
238
239
240
241
242
243
244
245
246
247static inline __must_check size_t array_size(size_t a, size_t b)
248{
249 size_t bytes;
250
251 if (check_mul_overflow(a, b, &bytes))
252 return SIZE_MAX;
253
254 return bytes;
255}
256
257
258
259
260
261
262
263
264
265
266
267
268
269static inline __must_check size_t array3_size(size_t a, size_t b, size_t c)
270{
271 size_t bytes;
272
273 if (check_mul_overflow(a, b, &bytes))
274 return SIZE_MAX;
275 if (check_mul_overflow(bytes, c, &bytes))
276 return SIZE_MAX;
277
278 return bytes;
279}
280
281static inline __must_check size_t __ab_c_size(size_t n, size_t size, size_t c)
282{
283 size_t bytes;
284
285 if (check_mul_overflow(n, size, &bytes))
286 return SIZE_MAX;
287 if (check_add_overflow(bytes, c, &bytes))
288 return SIZE_MAX;
289
290 return bytes;
291}
292
293
294
295
296
297
298
299
300
301
302
303
304#define struct_size(p, member, n) \
305 __ab_c_size(n, \
306 sizeof(*(p)->member) + __must_be_array((p)->member),\
307 sizeof(*(p)))
308
309#endif
310