From 223aa25aee82e188ddf043a8703b16e5fdfc37d8 Mon Sep 17 00:00:00 2001 From: Eliot Courtney Date: Mon, 10 Aug 2026 22:55:24 +0900 Subject: [PATCH] rust: num: reject Bounded::shr overshifts at build time Make `shr` reject shifts of at least the type's bit width at build time, instead of panicking or masking the shift amount at runtime. [ This implies we can break the type invariant, which in turn means we can trigger UB via `Deref`, e.g.: rust_kernel: panicked at rust/kernel/num/bounded.rs:528:22: unsafe precondition(s) violated: hint::unreachable_unchecked must never be reached - Miguel ] Signed-off-by: Eliot Courtney Acked-by: Alexandre Courbot Reviewed-by: Gary Guo Reviewed-by: Danilo Krummrich Cc: stable@vger.kernel.org Fixes: c59a2d14cd24 ("rust: num: add `shr` and `shl` methods to `Bounded`") Link: https://patch.msgid.link/20260810-pramin-split-v2-2-65a00b3c7309@nvidia.com Signed-off-by: Miguel Ojeda --- rust/kernel/num/bounded.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/rust/kernel/num/bounded.rs b/rust/kernel/num/bounded.rs index 9ad7df1a243d..90483d2c5374 100644 --- a/rust/kernel/num/bounded.rs +++ b/rust/kernel/num/bounded.rs @@ -485,6 +485,7 @@ pub fn cast(self) -> Bounded /// assert_eq!(v_shifted.get(), 0xff); /// ``` pub fn shr(self) -> Bounded { + const_assert!(SHIFT < T::BITS); const_assert!(RES + SHIFT >= N); // SAFETY: We shift the value right by `SHIFT`, reducing the number of bits needed to