| Message ID | 20250218081217.3468369-1-eleanor15x@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 606572eb22c1786a3957d24307f5760bb058ca19 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] sctp: Fix undefined behavior in left shift operation | expand |
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski <kuba@kernel.org>: On Tue, 18 Feb 2025 16:12:16 +0800 you wrote: > According to the C11 standard (ISO/IEC 9899:2011, 6.5.7): > "If E1 has a signed type and E1 x 2^E2 is not representable in the result > type, the behavior is undefined." > > Shifting 1 << 31 causes signed integer overflow, which leads to undefined > behavior. > > [...] Here is the summary with links: - [net] sctp: Fix undefined behavior in left shift operation https://git.kernel.org/netdev/net/c/606572eb22c1 You are awesome, thank you!
diff --git a/net/sctp/stream.c b/net/sctp/stream.c index c241cc552e8d..bfcff6d6a438 100644 --- a/net/sctp/stream.c +++ b/net/sctp/stream.c @@ -735,7 +735,7 @@ struct sctp_chunk *sctp_process_strreset_tsnreq( * value SHOULD be the smallest TSN not acknowledged by the * receiver of the request plus 2^31. */ - init_tsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + (1 << 31); + init_tsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + (1U << 31); sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL, init_tsn, GFP_ATOMIC);
According to the C11 standard (ISO/IEC 9899:2011, 6.5.7): "If E1 has a signed type and E1 x 2^E2 is not representable in the result type, the behavior is undefined." Shifting 1 << 31 causes signed integer overflow, which leads to undefined behavior. Fix this by explicitly using '1U << 31' to ensure the shift operates on an unsigned type, avoiding undefined behavior. Signed-off-by: Yu-Chun Lin <eleanor15x@gmail.com> --- net/sctp/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)