diff options
| author | Eliot Courtney <ecourtney@nvidia.com> | 2026-08-10 22:55:24 +0900 |
|---|---|---|
| committer | Miguel Ojeda <ojeda@kernel.org> | 2026-08-11 11:36:39 +0200 |
| commit | 223aa25aee82e188ddf043a8703b16e5fdfc37d8 (patch) | |
| tree | 56e95d5ee07059eea395ad988262b7bc543cdaa3 /rust/kernel/num | |
| parent | 119b5984675cb43c2ecdf54195b418d3155eef94 (diff) | |
rust: num: reject Bounded::shr overshifts at build time
Make `shr` reject shifts of at least the type's bit width at build
time, instead of panicking or masking the shift amount at runtime.
[ This implies we can break the type invariant, which in turn means
we can trigger UB via `Deref`, e.g.:
rust_kernel: panicked at rust/kernel/num/bounded.rs:528:22:
unsafe precondition(s) violated: hint::unreachable_unchecked must never be reached
- Miguel ]
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Fixes: c59a2d14cd24 ("rust: num: add `shr` and `shl` methods to `Bounded`")
Link: https://patch.msgid.link/20260810-pramin-split-v2-2-65a00b3c7309@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Diffstat (limited to 'rust/kernel/num')
| -rw-r--r-- | rust/kernel/num/bounded.rs | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/rust/kernel/num/bounded.rs b/rust/kernel/num/bounded.rs index 9ad7df1a243d..90483d2c5374 100644 --- a/rust/kernel/num/bounded.rs +++ b/rust/kernel/num/bounded.rs @@ -485,6 +485,7 @@ where /// assert_eq!(v_shifted.get(), 0xff); /// ``` pub fn shr<const SHIFT: u32, const RES: u32>(self) -> Bounded<T, RES> { + const_assert!(SHIFT < T::BITS); const_assert!(RES + SHIFT >= N); // SAFETY: We shift the value right by `SHIFT`, reducing the number of bits needed to |