• Daniel Borkmann's avatar
    net: llc: fix order of evaluation in llc_conn_ac_inc_vr_by_1 · 7e030963
    Daniel Borkmann authored
    Function llc_conn_ac_inc_vr_by_1() evaluates via macro
    PDU_GET_NEXT_Vr() into ...
    
      llc_sk(sk)->vR = ++llc_sk(sk)->vR & 0xffffffffffffff7f
    
    ... but the order in which the side effects take place is
    undefined because there is no intervening sequence point.
    
    As llc_sk(sk)->vR is written in llc_sk(sk)->vR (assignment
    left-hand side) and written in ++llc_sk(sk)->vR & 0xffffffffffffff7f
    this might possibly yield undefined behavior.
    
    The final value of llc_sk(sk)->vR is ambiguous, because,
    depending on the order of expression evaluation, the
    increment may occur before, after, or interleaved with
    the assignment. In C, evaluating such an expression yields
    undefined behavior.
    
    Since we're doing the increment via PDU_GET_NEXT_Vr() macro
    and the only place it is being used is from
    llc_conn_ac_inc_vr_by_1(), in order to increment vR by 1
    with a follow-up optimized modulo, rewrite the expression
    into ((vR + 1) & CONST) in order to fix this.
    Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
    Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
    Cc: Stephen Hemminger <stephen@networkplumber.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    7e030963
llc_pdu.h 14.1 KB