On Fri, Sep 05, 2025 at 10:25:49AM +0200, Arnd Bergmann wrote:
On Fri, Sep 5, 2025, at 07:28, Kees Cook wrote:
After commit cbc654d18d37 ("bitops: Add __attribute_const__ to generic ffs()-family implementations"), which allows GCC's value range tracker to see past ffs(), GCC 8 on ARM thinks that it might be possible that "ffs(rq) - 8" used here:
v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8);
could wrap below 0, leading to a very large value, which would be out of range for the FIELD_PREP() usage:
drivers/pci/pci.c: In function 'pcie_set_readrq': include/linux/compiler_types.h:572:38: error: call to '__compiletime_assert_471' declared with attribute error: FIELD_PREP: value too large for the field ... drivers/pci/pci.c:5896:6: note: in expansion of macro 'FIELD_PREP' v = FIELD_PREP(PCI_EXP_DEVCTL_READRQ, ffs(rq) - 8); ^~~~~~~~~~
If the result of the ffs() is bounds checked before being used in FIELD_PREP(), the value tracker seems happy again. :)
Fixes: cbc654d18d37 ("bitops: Add __attribute_const__ to generic ffs()-family implementations") Reported-by: Linux Kernel Functional Testing lkft@linaro.org Closes: https://lore.kernel.org/linux-pci/CA+G9fYuysVr6qT8bjF6f08WLyCJRG7aXAeSd2F7=z... Signed-off-by: Kees Cook kees@kernel.org
Acked-by: Arnd Bergmann arnd@arndb.de
This looks good to me individually, however I have now tried to do more randconfig tests with the __attribute_const change and gcc-8.5.0, and so far found two other files with the same issue:
In file included from <command-line>: In function 'mtk_dai_etdm_out_configure.constprop', inlined from 'mtk_dai_etdm_configure' at sound/soc/mediatek/mt8188/mt8188-dai-etdm.c:2168:3: include/linux/compiler_types.h:575:38: error: call to '__compiletime_assert_416' declared with attribute error: FIELD_PREP: value too large for the field sound/soc/mediatek/mt8188/mt8188-dai-etdm.c:2065:10: note: in expansion of macro 'FIELD_PREP' val |= FIELD_PREP(ETDM_OUT_CON4_FS_MASK, get_etdm_fs_timing(rate)); sound/soc/mediatek/mt8188/mt8188-dai-etdm.c:1971:10: note: in expansion of macro 'FIELD_PREP' val |= FIELD_PREP(ETDM_IN_CON3_FS_MASK, get_etdm_fs_timing(rate));
drivers/mmc/host/meson-gx-mmc.c: In function 'meson_mmc_start_cmd': drivers/mmc/host/meson-gx-mmc.c:811:14: note: in expansion of macro 'FIELD_PREP' cmd_cfg |= FIELD_PREP(CMD_CFG_TIMEOUT_MASK,
I can't see how these are related to ffs()...
This is fairly rare, but over time there are likely going to be others like them. I see three possible ways forward here:
a) fix them individually as we run into them, hoping for the best
I think they are valid warnings, so my instinct would be to fix them as they appear. (e.g. "0 - 8" isn't something FIELD_PREP can do anything about.)
-Kees