The VDSO implementation includes headers from outside of the
vdso/ namespace.

Split linux/minmax.h to make sure that the generic library
uses only the allowed namespace.

Cc: Andy Lutomirski <luto@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
---
 include/linux/minmax.h | 28 +---------------------------
 include/vdso/minmax.h  | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 27 deletions(-)
 create mode 100644 include/vdso/minmax.h

diff --git a/include/linux/minmax.h b/include/linux/minmax.h
index 98008dd92153..846e3fa65c96 100644
--- a/include/linux/minmax.h
+++ b/include/linux/minmax.h
@@ -6,6 +6,7 @@
 #include <linux/compiler.h>
 #include <linux/const.h>
 #include <linux/types.h>
+#include <vdso/minmax.h>
 
 /*
  * min()/max()/clamp() macros must accomplish three things:
@@ -84,17 +85,6 @@
 #define __types_ok3(x,y,z,ux,uy,uz) \
 	(__sign_use(x,ux) & __sign_use(y,uy) & __sign_use(z,uz))
 
-#define __cmp_op_min <
-#define __cmp_op_max >
-
-#define __cmp(op, x, y)	((x) __cmp_op_##op (y) ? (x) : (y))
-
-#define __cmp_once_unique(op, type, x, y, ux, uy) \
-	({ type ux = (x); type uy = (y); __cmp(op, ux, uy); })
-
-#define __cmp_once(op, type, x, y) \
-	__cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
-
 #define __careful_cmp_once(op, x, y, ux, uy) ({		\
 	__auto_type ux = (x); __auto_type uy = (y);	\
 	BUILD_BUG_ON_MSG(!__types_ok(x,y,ux,uy),	\
@@ -204,22 +194,6 @@
  * Or not use min/max/clamp at all, of course.
  */
 
-/**
- * min_t - return minimum of two values, using the specified type
- * @type: data type to use
- * @x: first value
- * @y: second value
- */
-#define min_t(type, x, y) __cmp_once(min, type, x, y)
-
-/**
- * max_t - return maximum of two values, using the specified type
- * @type: data type to use
- * @x: first value
- * @y: second value
- */
-#define max_t(type, x, y) __cmp_once(max, type, x, y)
-
 /*
  * Do not check the array parameter using __must_be_array().
  * In the following legit use-case where the "array" passed is a simple pointer,
diff --git a/include/vdso/minmax.h b/include/vdso/minmax.h
new file mode 100644
index 000000000000..26724f34c513
--- /dev/null
+++ b/include/vdso/minmax.h
@@ -0,0 +1,38 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __VDSO_MINMAX_H
+#define __VDSO_MINMAX_H
+
+#ifndef __ASSEMBLY__
+
+#include <linux/compiler.h>
+
+#define __cmp_op_min <
+#define __cmp_op_max >
+
+#define __cmp(op, x, y)	((x) __cmp_op_##op (y) ? (x) : (y))
+
+#define __cmp_once_unique(op, type, x, y, ux, uy) \
+	({ type ux = (x); type uy = (y); __cmp(op, ux, uy); })
+
+#define __cmp_once(op, type, x, y) \
+	__cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
+
+/**
+ * min_t - return minimum of two values, using the specified type
+ * @type: data type to use
+ * @x: first value
+ * @y: second value
+ */
+#define min_t(type, x, y) __cmp_once(min, type, x, y)
+
+/**
+ * max_t - return maximum of two values, using the specified type
+ * @type: data type to use
+ * @x: first value
+ * @y: second value
+ */
+#define max_t(type, x, y) __cmp_once(max, type, x, y)
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __VDSO_MINMAX_H */
-- 
2.34.1

Le 03/09/2024 à 17:14, Vincenzo Frascino a écrit :
> The VDSO implementation includes headers from outside of the
> vdso/ namespace.
> 
> Split linux/minmax.h to make sure that the generic library
> uses only the allowed namespace.

It is probably easier to just don't use min_t() in VDSO. Can be open 
coded without impeeding readability.

> 
> Cc: Andy Lutomirski <luto@kernel.org>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Jason A. Donenfeld <Jason@zx2c4.com>
> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
> ---
>   include/linux/minmax.h | 28 +---------------------------
>   include/vdso/minmax.h  | 38 ++++++++++++++++++++++++++++++++++++++
>   2 files changed, 39 insertions(+), 27 deletions(-)
>   create mode 100644 include/vdso/minmax.h
> 
> diff --git a/include/linux/minmax.h b/include/linux/minmax.h
> index 98008dd92153..846e3fa65c96 100644
> --- a/include/linux/minmax.h
> +++ b/include/linux/minmax.h
> @@ -6,6 +6,7 @@
>   #include <linux/compiler.h>
>   #include <linux/const.h>
>   #include <linux/types.h>
> +#include <vdso/minmax.h>
>   
>   /*
>    * min()/max()/clamp() macros must accomplish three things:
> @@ -84,17 +85,6 @@
>   #define __types_ok3(x,y,z,ux,uy,uz) \
>   	(__sign_use(x,ux) & __sign_use(y,uy) & __sign_use(z,uz))
>   
> -#define __cmp_op_min <
> -#define __cmp_op_max >
> -
> -#define __cmp(op, x, y)	((x) __cmp_op_##op (y) ? (x) : (y))
> -
> -#define __cmp_once_unique(op, type, x, y, ux, uy) \
> -	({ type ux = (x); type uy = (y); __cmp(op, ux, uy); })
> -
> -#define __cmp_once(op, type, x, y) \
> -	__cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
> -
>   #define __careful_cmp_once(op, x, y, ux, uy) ({		\
>   	__auto_type ux = (x); __auto_type uy = (y);	\
>   	BUILD_BUG_ON_MSG(!__types_ok(x,y,ux,uy),	\
> @@ -204,22 +194,6 @@
>    * Or not use min/max/clamp at all, of course.
>    */
>   
> -/**
> - * min_t - return minimum of two values, using the specified type
> - * @type: data type to use
> - * @x: first value
> - * @y: second value
> - */
> -#define min_t(type, x, y) __cmp_once(min, type, x, y)
> -
> -/**
> - * max_t - return maximum of two values, using the specified type
> - * @type: data type to use
> - * @x: first value
> - * @y: second value
> - */
> -#define max_t(type, x, y) __cmp_once(max, type, x, y)
> -
>   /*
>    * Do not check the array parameter using __must_be_array().
>    * In the following legit use-case where the "array" passed is a simple pointer,
> diff --git a/include/vdso/minmax.h b/include/vdso/minmax.h
> new file mode 100644
> index 000000000000..26724f34c513
> --- /dev/null
> +++ b/include/vdso/minmax.h
> @@ -0,0 +1,38 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +#ifndef __VDSO_MINMAX_H
> +#define __VDSO_MINMAX_H
> +
> +#ifndef __ASSEMBLY__
> +
> +#include <linux/compiler.h>
> +
> +#define __cmp_op_min <
> +#define __cmp_op_max >
> +
> +#define __cmp(op, x, y)	((x) __cmp_op_##op (y) ? (x) : (y))
> +
> +#define __cmp_once_unique(op, type, x, y, ux, uy) \
> +	({ type ux = (x); type uy = (y); __cmp(op, ux, uy); })
> +
> +#define __cmp_once(op, type, x, y) \
> +	__cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
> +
> +/**
> + * min_t - return minimum of two values, using the specified type
> + * @type: data type to use
> + * @x: first value
> + * @y: second value
> + */
> +#define min_t(type, x, y) __cmp_once(min, type, x, y)
> +
> +/**
> + * max_t - return maximum of two values, using the specified type
> + * @type: data type to use
> + * @x: first value
> + * @y: second value
> + */
> +#define max_t(type, x, y) __cmp_once(max, type, x, y)
> +
> +#endif /* !__ASSEMBLY__ */
> +
> +#endif /* __VDSO_MINMAX_H */

On Wed, Sep 4, 2024, at 17:17, Christophe Leroy wrote:
> Le 03/09/2024 à 17:14, Vincenzo Frascino a écrit :
>> The VDSO implementation includes headers from outside of the
>> vdso/ namespace.
>> 
>> Split linux/minmax.h to make sure that the generic library
>> uses only the allowed namespace.
>
> It is probably easier to just don't use min_t() in VDSO. Can be open 
> coded without impeeding readability.

Right, or possibly the even simpler MIN()/MAX() if the arguments
have no side-effects.

       Arnd

On 04/09/2024 18:23, Arnd Bergmann wrote:
> On Wed, Sep 4, 2024, at 17:17, Christophe Leroy wrote:
>> Le 03/09/2024 à 17:14, Vincenzo Frascino a écrit :
>>> The VDSO implementation includes headers from outside of the
>>> vdso/ namespace.
>>>
>>> Split linux/minmax.h to make sure that the generic library
>>> uses only the allowed namespace.
>>
>> It is probably easier to just don't use min_t() in VDSO. Can be open 
>> coded without impeeding readability.
> 
> Right, or possibly the even simpler MIN()/MAX() if the arguments
> have no side-effects.
> 

Agreed, generally I do not like open-coding since it tends to introduce
duplication, but these cases are simple especially if we can use MIN()/MAX().

>        Arnd

-- 
Regards,
Vincenzo

From: Vincenzo Frascino
> Sent: 06 September 2024 12:41
> 
> On 04/09/2024 18:23, Arnd Bergmann wrote:
> > On Wed, Sep 4, 2024, at 17:17, Christophe Leroy wrote:
> >> Le 03/09/2024 à 17:14, Vincenzo Frascino a écrit :
> >>> The VDSO implementation includes headers from outside of the
> >>> vdso/ namespace.
> >>>
> >>> Split linux/minmax.h to make sure that the generic library
> >>> uses only the allowed namespace.
> >>
> >> It is probably easier to just don't use min_t() in VDSO. Can be open
> >> coded without impeeding readability.
> >
> > Right, or possibly the even simpler MIN()/MAX() if the arguments
> > have no side-effects.
> >
> 
> Agreed, generally I do not like open-coding since it tends to introduce
> duplication, but these cases are simple especially if we can use MIN()/MAX().

Aren't MIN()/MAX() likely to get defined in minmax.h for cases where the
arguments are constants - and maybe have checks that they are constants.
So you don't want to define them in the VDSO header either.

Open coding simple cases is actually easier to read :-)

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)