Messages in this thread | | | Date | Tue, 3 Nov 2015 12:44:51 -0800 | Subject | Re: [GIT] Networking | From | Linus Torvalds <> |
| |
On Tue, Nov 3, 2015 at 12:05 PM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > result = add_overflow( > mul_overflow(sec, SEC_CONVERSION, &overflow), > mul_overflow(nsec, NSEC_CONVERSION, &overflow), > &overflow); > > return overflow ? MAX_JIFFIES : result;
Thinking more about this example, I think the gcc interface for multiplication overflow is fine.
It would end up something like
if (mul_overflow(sec, SEC_CONVERSION, &sec)) return MAX_JIFFY_OFFSET; if (mul_overflow(nsec, NSEC_CONVERSION, &nsec)) return MAX_JIFFY_OFFSET; sum = sec + nsec; if (sum < sec || sum > MAX_JIFFY_OFFSET) return MAX_JIFFY_OFFSET; return sum;
and that doesn't look horribly ugly to me.
That said, I do wonder how many of our interfaces really want overflow, and how many just want saturation (or even clamping to a maximum value).
For example, one of the *common* cases of multiplication overflow we have had is for memory allocation where we do things like
buffer = kmalloc(sizeof(something) * nr, GFP_KERNEL);
and we've fixed them by moving them to 'kcalloc()'. But as with the jiffies conversion above, it would actually be sufficient to just saturate to a maximum value instead, and depending on that causing the allocation to fail.
So it may actually be that most users really don't even *want* "overflow".
Does anybody have any particular other "uhhuh, overflow in multiplication" issues in mind? Because the interface for a saturating multiplication (or addition, for that matter) would actually be much easier. And would be trivial to have as an inline asm for compatibility with older versions of gcc too.
Then you could just do that jiffies conversion - or allocation, for that matter - without any special overflow handling at all. Doing
buf = kmalloc(sat_mul(sizeof(x), nr), GFP_KERNEL);
would just magically work.
And the above jiffies conversion would still want to clamp things to MAX_JIFFY_OFFSET (because we consider "jiffies" to be an offset from now, and while it's "unsigned long", we clamp the offset to half the range), but it would still be a rather natural model for it too.
Linus
| |