Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp6268867imu; Mon, 21 Jan 2019 06:08:12 -0800 (PST) X-Google-Smtp-Source: ALg8bN6wlEVFFsTiCrDt8BzbJuEt4UJ5eeRxtUWDl/JrG7zl8AZkAxN9cs5fZsMJxdiManJ2ewCQ X-Received: by 2002:a63:7f4f:: with SMTP id p15mr28520955pgn.296.1548079692656; Mon, 21 Jan 2019 06:08:12 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1548079692; cv=none; d=google.com; s=arc-20160816; b=bMb4M3W/uNW7sgzA01VK2RZR9vnoi5L0jU0rf13ie/otrqrkBg9v5kxMkb7Ja8LeNl 2tZOufHAumxy6fpTIFVjtp7BeA8QRSKp/mNfcuH1DyNUp5uWXS1ipsvaob6/DhsQSh2Y T3tHvxa4LA5m5HjewqDrsHsiylrontGxCHAg1tgKrshnj/Pm90dNCjhlPqszHqMY40A0 JMpg2sFfXshQR8ELY5CZ3qyAC4PthYv+tmN4S1DwnASBL2YWmFncG31Ye2xLgSDQqEr5 mext8Fedf4KW50Q8gGMZFUif0dAYS+SPIlvBUOToZCT3dNJzagOlHbX+fH0mqehYNl15 /Z4w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=D1PgVmmtc6qZ4OjSOV7dOL6BSZji2dFDagnFAGmav5E=; b=pdWfCx8uemDMnLRcLvVC5wPOKLG+XMzjrGlhdxk63OEPjNR+XAGpr1X4zEOIfUXjos C9HzcMR13Q8sX6CCINqQ4I4cJn+B6AIHuj1fDDukhA0SyEUc1cnowFFMJ4KWavgeVrtQ FK0RoIZ/MuRRlIq953EKRavRnU57DnE3+2xf50Rhh3SgTswu39htbcJAqoLoCLVThZCf zMafPQl1o8sJQAgtGB8HmPsQqD+IaRm8CEcO3rx7uy9CzQ/UjfUcckOaF4H9dYNJlUwN G4FvEIevd86HrLxl2L/cq8p7LG85XoTSy+RAUxWJkSUBok0tShtDjBaPPXN5HjJzm2Yl Y6xw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=jGY87RW6; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id g9si12733635pfd.86.2019.01.21.06.07.57; Mon, 21 Jan 2019 06:08:12 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=jGY87RW6; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732017AbfAUOAz (ORCPT + 99 others); Mon, 21 Jan 2019 09:00:55 -0500 Received: from mail.kernel.org ([198.145.29.99]:47712 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732517AbfAUOAx (ORCPT ); Mon, 21 Jan 2019 09:00:53 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EEC1320879; Mon, 21 Jan 2019 14:00:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1548079252; bh=LxAnSu5JQkl2P6hyBMpzA9aKkSNd5wdm9ojqCVl6YvM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jGY87RW6TvOQt9QFDgQ7xnYiZAjblt7JCxGGz6Yal3DB+JJdDBF2Qb7YRATbi2MmN mP0twj6TdonJcyR6m1Mb1g7AFLcvfkdJxWwA0s7fPVrWH+kLzpv2Y0Pp8Id125R6Pn mC3+JtNnJpNyj+pugdoKi8hAYcmJAbTcnZfwxIh4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Florian La Roche , Will Deacon , Linus Torvalds Subject: [PATCH 4.19 60/99] fix int_sqrt64() for very large numbers Date: Mon, 21 Jan 2019 14:48:52 +0100 Message-Id: <20190121134916.252080272@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190121134913.924726465@linuxfoundation.org> References: <20190121134913.924726465@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.19-stable review patch. If anyone has any objections, please let me know. ------------------ From: Florian La Roche commit fbfaf851902cd9293f392f3a1735e0543016d530 upstream. If an input number x for int_sqrt64() has the highest bit set, then fls64(x) is 64. (1UL << 64) is an overflow and breaks the algorithm. Subtracting 1 is a better guess for the initial value of m anyway and that's what also done in int_sqrt() implicitly [*]. [*] Note how int_sqrt() uses __fls() with two underscores, which already returns the proper raw bit number. In contrast, int_sqrt64() used fls64(), and that returns bit numbers illogically starting at 1, because of error handling for the "no bits set" case. Will points out that he bug probably is due to a copy-and-paste error from the regular int_sqrt() case. Signed-off-by: Florian La Roche Acked-by: Will Deacon Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- lib/int_sqrt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/lib/int_sqrt.c +++ b/lib/int_sqrt.c @@ -52,7 +52,7 @@ u32 int_sqrt64(u64 x) if (x <= ULONG_MAX) return int_sqrt((unsigned long) x); - m = 1ULL << (fls64(x) & ~1ULL); + m = 1ULL << ((fls64(x) - 1) & ~1ULL); while (m != 0) { b = y + m; y >>= 1;