Commit 18af4c62 authored by Flavio Ceolin's avatar Flavio Ceolin Committed by Anas Nashif
Browse files

kernel: Fix overflow test problem introduced in 92ea2f91 



The builtin function __builtin_umul_overflow returns a boolean and
should not checked as an integer.

Signed-off-by: default avatarFlavio Ceolin <flavio.ceolin@intel.com>
parent 57a8db77

kernel/include/syscall_handler.h

+2 −2
Original line number Diff line number Diff line
@@ -351,9 +351,9 @@ bool z_syscall_verify_msg(bool expr, const char *fmt, ...) 
#define Z_SYSCALL_MEMORY_ARRAY(ptr, nmemb, size, write) \

	({ \

		u32_t product; \

		Z_SYSCALL_VERIFY_MSG(__builtin_umul_overflow((u32_t)(nmemb), \

		Z_SYSCALL_VERIFY_MSG(!__builtin_umul_overflow((u32_t)(nmemb), \

							      (u32_t)(size), \

							      &product) == 0,\

							      &product), \

				     "%ux%u array is too large", \

				     (u32_t)(nmemb), (u32_t)(size)) ||  \

			Z_SYSCALL_MEMORY(ptr, product, write); \

kernel/poll.c

+2 −2
Original line number Diff line number Diff line
@@ -259,9 +259,9 @@ Z_SYSCALL_HANDLER(k_poll, events, num_events, timeout) 
		goto out;

	}

	if (Z_SYSCALL_VERIFY_MSG(

		__builtin_umul_overflow(num_events,

		!__builtin_umul_overflow(num_events,

					sizeof(struct k_poll_event),

					&bounds) == 0,

					&bounds),

					"num_events too large")) {

		ret = -EINVAL;

		goto out;

kernel/thread.c

+2 −2
Original line number Diff line number Diff line
@@ -463,9 +463,9 @@ Z_SYSCALL_HANDLER(k_thread_create, 
	 * size and not allocated in addition to the stack size

	 */

	guard_size = (u32_t)K_THREAD_STACK_BUFFER(stack) - (u32_t)stack;

	Z_OOPS(Z_SYSCALL_VERIFY_MSG(__builtin_uadd_overflow(guard_size,

	Z_OOPS(Z_SYSCALL_VERIFY_MSG(!__builtin_uadd_overflow(guard_size,

							     stack_size,

							     &total_size) == 0,

							     &total_size),

				    "stack size overflow (%u+%u)", stack_size,

				    guard_size));

#else

CRA Git | Maintained and supported by SUSTech CRA and CCSE