1 /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ 2 3 #ifndef __LINUX_OVERFLOW_H 4 #define __LINUX_OVERFLOW_H 5 6 #define is_signed_type(type) (((type)(-1)) < (type)1) 7 #define __type_half_max(type) ((type)1 << (8*sizeof(type) - 1 - is_signed_type(type))) 8 #define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T))) 9 #define type_min(T) ((T)((T)-type_max(T)-(T)1)) 10 11 #ifndef unlikely 12 #define unlikely(x) __builtin_expect(!!(x), 0) 13 #endif 14 15 #ifdef __GNUC__ 16 #define GCC_VERSION (__GNUC__ * 10000 \ 17 + __GNUC_MINOR__ * 100 \ 18 + __GNUC_PATCHLEVEL__) 19 #if GCC_VERSION >= 50100 20 #define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1 21 #endif 22 #endif 23 24 #ifdef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 25 26 #define check_mul_overflow(a, b, d) ({ \ 27 typeof(a) __a = (a); \ 28 typeof(b) __b = (b); \ 29 typeof(d) __d = (d); \ 30 (void) (&__a == &__b); \ 31 (void) (&__a == __d); \ 32 __builtin_mul_overflow(__a, __b, __d); \ 33 }) 34 35 #else 36 37 /* 38 * If one of a or b is a compile-time constant, this avoids a division. 39 */ 40 #define __unsigned_mul_overflow(a, b, d) ({ \ 41 typeof(a) __a = (a); \ 42 typeof(b) __b = (b); \ 43 typeof(d) __d = (d); \ 44 (void) (&__a == &__b); \ 45 (void) (&__a == __d); \ 46 *__d = __a * __b; \ 47 __builtin_constant_p(__b) ? \ 48 __b > 0 && __a > type_max(typeof(__a)) / __b : \ 49 __a > 0 && __b > type_max(typeof(__b)) / __a; \ 50 }) 51 52 /* 53 * Signed multiplication is rather hard. gcc always follows C99, so 54 * division is truncated towards 0. This means that we can write the 55 * overflow check like this: 56 * 57 * (a > 0 && (b > MAX/a || b < MIN/a)) || 58 * (a < -1 && (b > MIN/a || b < MAX/a) || 59 * (a == -1 && b == MIN) 60 * 61 * The redundant casts of -1 are to silence an annoying -Wtype-limits 62 * (included in -Wextra) warning: When the type is u8 or u16, the 63 * __b_c_e in check_mul_overflow obviously selects 64 * __unsigned_mul_overflow, but unfortunately gcc still parses this 65 * code and warns about the limited range of __b. 66 */ 67 68 #define __signed_mul_overflow(a, b, d) ({ \ 69 typeof(a) __a = (a); \ 70 typeof(b) __b = (b); \ 71 typeof(d) __d = (d); \ 72 typeof(a) __tmax = type_max(typeof(a)); \ 73 typeof(a) __tmin = type_min(typeof(a)); \ 74 (void) (&__a == &__b); \ 75 (void) (&__a == __d); \ 76 *__d = (__u64)__a * (__u64)__b; \ 77 (__b > 0 && (__a > __tmax/__b || __a < __tmin/__b)) || \ 78 (__b < (typeof(__b))-1 && (__a > __tmin/__b || __a < __tmax/__b)) || \ 79 (__b == (typeof(__b))-1 && __a == __tmin); \ 80 }) 81 82 #define check_mul_overflow(a, b, d) \ 83 __builtin_choose_expr(is_signed_type(typeof(a)), \ 84 __signed_mul_overflow(a, b, d), \ 85 __unsigned_mul_overflow(a, b, d)) 86 87 88 #endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */ 89 90 #endif 91