From nobody Thu Oct 2 09:18:54 2025 Received: from fra-out-011.esa.eu-central-1.outbound.mail-perimeter.amazon.com (fra-out-011.esa.eu-central-1.outbound.mail-perimeter.amazon.com [52.28.197.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 20F172FBDF8; Fri, 19 Sep 2025 10:22:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=52.28.197.132 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758277367; cv=none; b=P8qtVL5cPitB0Vy0+dySsg6cT69NsqVa5MS6tlsVtzbibBY4ybMUxFyuiX+Pceb5Con5i64Zv8y7jBS8dOXimjGv0p3ddfRB5rb2kryedryaNc7Qls04Oq1bdppITco19cz4J56UlI8BFXs8qUWZYxo+6Ll7cvmR7QIBO4jfKFk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758277367; c=relaxed/simple; bh=JEYc4CItGCBWUkoOIUoWprHXQoWFFIqWm8tkxe6DE7s=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=g90o4fx88J9TVBo/H1VfeFVDUZyR0wD8itRHQ4LFexlS0dWOJFd+XAe1mlkw3J7i3PceZ5B4t6LBTT49hDA485UGEAALA1QUWqoQVo9RkqPcVkfQ1oZawC/q+QlPBbSihENXZHFZKN++rKd5NAij1sUqB54b6hEE/mCbj/SUVqc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com; spf=pass smtp.mailfrom=amazon.com; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b=fLPVZZ6j; arc=none smtp.client-ip=52.28.197.132 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amazon.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b="fLPVZZ6j" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazoncorp2; t=1758277365; x=1789813365; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=UnBmV/SkhIg5SgTRTNSUlBFA6sgQ2eBqJGsC4N+ceR0=; b=fLPVZZ6jHyrTspawVHAUxcGxAElNHEcR7Nof+s7ce9V1ptmkjxTCwcuD SWXipk48UrS+ul25Q7k1XNRRTUYAX6JAQluyBzTlpwHwQ+p8r89DLENBG aSKwZXhMwCAvDN3cjMOdYh9wCsC0WDfRACW0zU3LlqM9rdWfqO9Rt2b4R 0DEfmhWAAcYnsTWK5E4U6g8L8CdCouWts0GuudgnNQxSOT5/TeCqcEAGC Ap4GXG2N7fOCe7av3myF+iyb70lcJ2DacnEzneiBmWuWmG4KmtQmWa7nA NewrJMRV5WQwkV6Mz6a+xATxKXzgILTneEqAD7gPwyqV7cds7HLC+OlGy A==; X-CSE-ConnectionGUID: 3TCzpiVCSZicC8hivlyoVA== X-CSE-MsgGUID: x8LUi7xLRnS6sBxK1NL6MA== X-IronPort-AV: E=Sophos;i="6.18,277,1751241600"; d="scan'208";a="2263562" Received: from ip-10-6-6-97.eu-central-1.compute.internal (HELO smtpout.naws.eu-central-1.prod.farcaster.email.amazon.dev) ([10.6.6.97]) by internal-fra-out-011.esa.eu-central-1.outbound.mail-perimeter.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Sep 2025 10:22:41 +0000 Received: from EX19MTAEUB001.ant.amazon.com [54.240.197.226:15936] by smtpin.naws.eu-central-1.prod.farcaster.email.amazon.dev [10.0.1.3:2525] with esmtp (Farcaster) id 45c11765-985c-4cdc-9d4a-d154ac8e8fee; Fri, 19 Sep 2025 10:22:41 +0000 (UTC) X-Farcaster-Flow-ID: 45c11765-985c-4cdc-9d4a-d154ac8e8fee Received: from EX19D018EUA004.ant.amazon.com (10.252.50.85) by EX19MTAEUB001.ant.amazon.com (10.252.51.28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.20; Fri, 19 Sep 2025 10:22:39 +0000 Received: from dev-dsk-farbere-1a-46ecabed.eu-west-1.amazon.com (172.19.116.181) by EX19D018EUA004.ant.amazon.com (10.252.50.85) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.20; Fri, 19 Sep 2025 10:22:10 +0000 From: Eliav Farber To: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , CC: , Christoph Hellwig , Linus Torvalds Subject: [PATCH 08/27 5.10.y] minmax: allow min()/max()/clamp() if the arguments have the same signedness. Date: Fri, 19 Sep 2025 10:17:08 +0000 Message-ID: <20250919101727.16152-9-farbere@amazon.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20250919101727.16152-1-farbere@amazon.com> References: <20250919101727.16152-1-farbere@amazon.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: EX19D036UWC004.ant.amazon.com (10.13.139.205) To EX19D018EUA004.ant.amazon.com (10.252.50.85) Content-Type: text/plain; charset="utf-8" From: David Laight [ Upstream commit d03eba99f5bf7cbc6e2fdde3b6fa36954ad58e09 ] The type-check in min()/max() is there to stop unexpected results if a negative value gets converted to a large unsigned value. However it also rejects 'unsigned int' v 'unsigned long' compares which are common and never problematc. Replace the 'same type' check with a 'same signedness' check. The new test isn't itself a compile time error, so use static_assert() to report the error and give a meaningful error message. Due to the way builtin_choose_expr() works detecting the error in the 'non-constant' side (where static_assert() can be used) also detects errors when the arguments are constant. Link: https://lkml.kernel.org/r/fe7e6c542e094bfca655abcd323c1c98@AcuMS.acul= ab.com Signed-off-by: David Laight Cc: Andy Shevchenko Cc: Christoph Hellwig Cc: Jason A. Donenfeld Cc: Linus Torvalds Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton Signed-off-by: Eliav Farber --- include/linux/minmax.h | 60 ++++++++++++++++++++++-------------------- 1 file changed, 32 insertions(+), 28 deletions(-) diff --git a/include/linux/minmax.h b/include/linux/minmax.h index 2a197f54fe05..8718fd71a793 100644 --- a/include/linux/minmax.h +++ b/include/linux/minmax.h @@ -12,9 +12,8 @@ * * - avoid multiple evaluations of the arguments (so side-effects like * "x++" happen only once) when non-constant. - * - perform strict type-checking (to generate warnings instead of - * nasty runtime surprises). See the "unnecessary" pointer comparison - * in __typecheck(). + * - perform signed v unsigned type-checking (to generate compile + * errors instead of nasty runtime surprises). * - retain result as a constant expressions when called with only * constant expressions (to avoid tripping VLA warnings in stack * allocation usage). @@ -22,23 +21,30 @@ #define __typecheck(x, y) \ (!!(sizeof((typeof(x) *)1 =3D=3D (typeof(y) *)1))) =20 -#define __no_side_effects(x, y) \ - (__is_constexpr(x) && __is_constexpr(y)) +/* is_signed_type() isn't a constexpr for pointer types */ +#define __is_signed(x) \ + __builtin_choose_expr(__is_constexpr(is_signed_type(typeof(x))), \ + is_signed_type(typeof(x)), 0) =20 -#define __safe_cmp(x, y) \ - (__typecheck(x, y) && __no_side_effects(x, y)) +#define __types_ok(x, y) \ + (__is_signed(x) =3D=3D __is_signed(y)) =20 -#define __cmp(x, y, op) ((x) op (y) ? (x) : (y)) +#define __cmp_op_min < +#define __cmp_op_max > =20 -#define __cmp_once(x, y, unique_x, unique_y, op) ({ \ +#define __cmp(op, x, y) ((x) __cmp_op_##op (y) ? (x) : (y)) + +#define __cmp_once(op, x, y, unique_x, unique_y) ({ \ typeof(x) unique_x =3D (x); \ typeof(y) unique_y =3D (y); \ - __cmp(unique_x, unique_y, op); }) + static_assert(__types_ok(x, y), \ + #op "(" #x ", " #y ") signedness error, fix types or consider u" #op "(= ) before " #op "_t()"); \ + __cmp(op, unique_x, unique_y); }) =20 -#define __careful_cmp(x, y, op) \ - __builtin_choose_expr(__safe_cmp(x, y), \ - __cmp(x, y, op), \ - __cmp_once(x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y), op)) +#define __careful_cmp(op, x, y) \ + __builtin_choose_expr(__is_constexpr((x) - (y)), \ + __cmp(op, x, y), \ + __cmp_once(op, x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y))) =20 #define __clamp(val, lo, hi) \ ((val) >=3D (hi) ? (hi) : ((val) <=3D (lo) ? (lo) : (val))) @@ -47,17 +53,15 @@ typeof(val) unique_val =3D (val); \ typeof(lo) unique_lo =3D (lo); \ typeof(hi) unique_hi =3D (hi); \ + static_assert(__builtin_choose_expr(__is_constexpr((lo) > (hi)), \ + (lo) <=3D (hi), true), \ + "clamp() low limit " #lo " greater than high limit " #hi); \ + static_assert(__types_ok(val, lo), "clamp() 'lo' signedness error"); \ + static_assert(__types_ok(val, hi), "clamp() 'hi' signedness error"); \ __clamp(unique_val, unique_lo, unique_hi); }) =20 -#define __clamp_input_check(lo, hi) \ - (BUILD_BUG_ON_ZERO(__builtin_choose_expr( \ - __is_constexpr((lo) > (hi)), (lo) > (hi), false))) - #define __careful_clamp(val, lo, hi) ({ \ - __clamp_input_check(lo, hi) + \ - __builtin_choose_expr(__typecheck(val, lo) && __typecheck(val, hi) && \ - __typecheck(hi, lo) && __is_constexpr(val) && \ - __is_constexpr(lo) && __is_constexpr(hi), \ + __builtin_choose_expr(__is_constexpr((val) - (lo) + (hi)), \ __clamp(val, lo, hi), \ __clamp_once(val, lo, hi, __UNIQUE_ID(__val), \ __UNIQUE_ID(__lo), __UNIQUE_ID(__hi))); }) @@ -67,14 +71,14 @@ * @x: first value * @y: second value */ -#define min(x, y) __careful_cmp(x, y, <) +#define min(x, y) __careful_cmp(min, x, y) =20 /** * max - return maximum of two values of the same or compatible types * @x: first value * @y: second value */ -#define max(x, y) __careful_cmp(x, y, >) +#define max(x, y) __careful_cmp(max, x, y) =20 /** * umin - return minimum of two non-negative values @@ -83,7 +87,7 @@ * @y: second value */ #define umin(x, y) \ - __careful_cmp((x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull, <) + __careful_cmp(min, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull) =20 /** * umax - return maximum of two non-negative values @@ -91,7 +95,7 @@ * @y: second value */ #define umax(x, y) \ - __careful_cmp((x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull, >) + __careful_cmp(max, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull) =20 /** * min3 - return minimum of three values @@ -143,7 +147,7 @@ * @x: first value * @y: second value */ -#define min_t(type, x, y) __careful_cmp((type)(x), (type)(y), <) +#define min_t(type, x, y) __careful_cmp(min, (type)(x), (type)(y)) =20 /** * max_t - return maximum of two values, using the specified type @@ -151,7 +155,7 @@ * @x: first value * @y: second value */ -#define max_t(type, x, y) __careful_cmp((type)(x), (type)(y), >) +#define max_t(type, x, y) __careful_cmp(max, (type)(x), (type)(y)) =20 /* * Do not check the array parameter using __must_be_array(). --=20 2.47.3