From 1c88ceb09d5e5506456a625043bc9b35ce86fc41 Mon Sep 17 00:00:00 2001 From: Yury Norov Date: Mon, 14 Sep 2026 16:49:29 -0400 Subject: [PATCH 01/10] bitfield: get rid of __MAKE_OP machinery The __MAKE_OP machinery hides the fixed-width bitfield helper definitions from source searches and makes the end result highly obscured and largely uncontrolled. This follows earlier discussions about making these helpers easier to find: [1], [2]. Move the explicit helpers and their shared checks into linux/bitfield-fix-width.h in both the kernel and tools headers, and include it from bitfield.h to preserve existing users. The repeated overflow check is factored into __assert_field(), preserving the original condition and compile-time diagnostics. With GCC 15.2.0 and x86-64 defconfig plus the bitfield KUnit tests, the before/after kernel builds are binary identical. The __MAKE_OP generates the following 40 functions (including the direct ____MAKE_OP(u8,u8,,) invocation): u8_encode_bits() u8_replace_bits() u8p_replace_bits() u8_get_bits() le16_encode_bits() le16_replace_bits() [dead code] le16p_replace_bits() le16_get_bits() be16_encode_bits() be16_replace_bits() [dead code] be16p_replace_bits() [dead code] be16_get_bits() u16_encode_bits() u16_replace_bits() u16p_replace_bits() u16_get_bits() le32_encode_bits() le32_replace_bits() [dead code] le32p_replace_bits() le32_get_bits() be32_encode_bits() be32_replace_bits() [dead code] be32p_replace_bits() be32_get_bits() u32_encode_bits() u32_replace_bits() u32p_replace_bits() u32_get_bits() le64_encode_bits() le64_replace_bits() [dead code] le64p_replace_bits() [dead code] le64_get_bits() be64_encode_bits() be64_replace_bits() [dead code] be64p_replace_bits() [dead code] be64_get_bits() u64_encode_bits() u64_replace_bits() u64p_replace_bits() u64_get_bits() Functions marked with [dead code] have no in-tree callers and are removed by this change. Link: https://lore.kernel.org/all/20250214073402.0129e259@kernel.org/ [1] Link: https://lore.kernel.org/all/aeub59FBHbCy-KKP@yury/ [2] Assisted-by: OpenAI Codex Reviewed-by: Akihiko Odaki Acked-by: Jakub Kicinski Signed-off-by: Yury Norov --- MAINTAINERS | 2 + include/linux/bitfield-fix-width.h | 235 ++++++++++++++++++++++ include/linux/bitfield.h | 49 +---- tools/include/linux/bitfield-fix-width.h | 236 +++++++++++++++++++++++ tools/include/linux/bitfield.h | 49 +---- 5 files changed, 475 insertions(+), 96 deletions(-) create mode 100644 include/linux/bitfield-fix-width.h create mode 100644 tools/include/linux/bitfield-fix-width.h diff --git a/MAINTAINERS b/MAINTAINERS index cc3cae2e378b..9abdfef63d74 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -4638,6 +4638,7 @@ BITMAP API M: Yury Norov R: Rasmus Villemoes S: Maintained +F: include/linux/bitfield-fix-width.h F: include/linux/bitfield.h F: include/linux/bitmap-str.h F: include/linux/bitmap.h @@ -4658,6 +4659,7 @@ F: lib/find_bit_benchmark.c F: lib/region_alloc_benchmark.c F: lib/test_bitmap.c F: lib/tests/cpumask_kunit.c +F: tools/include/linux/bitfield-fix-width.h F: tools/include/linux/bitfield.h F: tools/include/linux/bitmap.h F: tools/include/linux/bits.h diff --git a/include/linux/bitfield-fix-width.h b/include/linux/bitfield-fix-width.h new file mode 100644 index 000000000000..fba86bb76999 --- /dev/null +++ b/include/linux/bitfield-fix-width.h @@ -0,0 +1,235 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef _LINUX_BITFIELD_FIX_WIDTH_H +#define _LINUX_BITFIELD_FIX_WIDTH_H + +#include +#include +#include + +extern void __compiletime_error("value doesn't fit into mask") +__field_overflow(void); + +extern void __compiletime_error("bad bitfield mask") +__bad_mask(void); + +static __always_inline +u64 field_multiplier(u64 field) +{ + if ((field | (field - 1)) & ((field | (field - 1)) + 1)) + __bad_mask(); + return field & -field; +} + +static __always_inline +u64 field_mask(u64 field) +{ + return field / field_multiplier(field); +} + +#define field_max(field) ((typeof(field))field_mask(field)) + +#define __assert_field(v, field) \ + do { \ + if (__builtin_constant_p(v) && \ + ((v) & ~field_mask(field))) \ + __field_overflow(); \ + } while (0) + +static __always_inline __must_check +__u8 u8_encode_bits(u8 v, u8 field) +{ + __assert_field(v, field); + return (v & field_mask(field)) * field_multiplier(field); +} + +static __always_inline __must_check +__u8 u8_replace_bits(__u8 old, u8 val, u8 field) +{ + return (old & ~field) | u8_encode_bits(val, field); +} + +static __always_inline +void u8p_replace_bits(__u8 *p, u8 val, u8 field) +{ + *p = (*p & ~field) | u8_encode_bits(val, field); +} + +static __always_inline __must_check +u8 u8_get_bits(__u8 v, u8 field) +{ + return (v & field) / field_multiplier(field); +} + +static __always_inline __must_check +__le16 le16_encode_bits(u16 v, u16 field) +{ + __assert_field(v, field); + return cpu_to_le16((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline +void le16p_replace_bits(__le16 *p, u16 val, u16 field) +{ + *p = (*p & ~cpu_to_le16(field)) | le16_encode_bits(val, field); +} + +static __always_inline __must_check +u16 le16_get_bits(__le16 v, u16 field) +{ + return (le16_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline __must_check +__be16 be16_encode_bits(u16 v, u16 field) +{ + __assert_field(v, field); + return cpu_to_be16((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline __must_check +u16 be16_get_bits(__be16 v, u16 field) +{ + return (be16_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline __must_check +__u16 u16_encode_bits(u16 v, u16 field) +{ + __assert_field(v, field); + return (v & field_mask(field)) * field_multiplier(field); +} + +static __always_inline __must_check +__u16 u16_replace_bits(__u16 old, u16 val, u16 field) +{ + return (old & ~field) | u16_encode_bits(val, field); +} + +static __always_inline +void u16p_replace_bits(__u16 *p, u16 val, u16 field) +{ + *p = (*p & ~field) | u16_encode_bits(val, field); +} + +static __always_inline __must_check +u16 u16_get_bits(__u16 v, u16 field) +{ + return (v & field) / field_multiplier(field); +} + +static __always_inline __must_check +__le32 le32_encode_bits(u32 v, u32 field) +{ + __assert_field(v, field); + return cpu_to_le32((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline +void le32p_replace_bits(__le32 *p, u32 val, u32 field) +{ + *p = (*p & ~cpu_to_le32(field)) | le32_encode_bits(val, field); +} + +static __always_inline __must_check +u32 le32_get_bits(__le32 v, u32 field) +{ + return (le32_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline __must_check +__be32 be32_encode_bits(u32 v, u32 field) +{ + __assert_field(v, field); + return cpu_to_be32((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline +void be32p_replace_bits(__be32 *p, u32 val, u32 field) +{ + *p = (*p & ~cpu_to_be32(field)) | be32_encode_bits(val, field); +} + +static __always_inline __must_check +u32 be32_get_bits(__be32 v, u32 field) +{ + return (be32_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline __must_check +__u32 u32_encode_bits(u32 v, u32 field) +{ + __assert_field(v, field); + return (v & field_mask(field)) * field_multiplier(field); +} + +static __always_inline __must_check +__u32 u32_replace_bits(__u32 old, u32 val, u32 field) +{ + return (old & ~field) | u32_encode_bits(val, field); +} + +static __always_inline +void u32p_replace_bits(__u32 *p, u32 val, u32 field) +{ + *p = (*p & ~field) | u32_encode_bits(val, field); +} + +static __always_inline __must_check +u32 u32_get_bits(__u32 v, u32 field) +{ + return (v & field) / field_multiplier(field); +} + +static __always_inline __must_check +__le64 le64_encode_bits(u64 v, u64 field) +{ + __assert_field(v, field); + return cpu_to_le64((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline __must_check +u64 le64_get_bits(__le64 v, u64 field) +{ + return (le64_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline __must_check +__be64 be64_encode_bits(u64 v, u64 field) +{ + __assert_field(v, field); + return cpu_to_be64((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline __must_check +u64 be64_get_bits(__be64 v, u64 field) +{ + return (be64_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline __must_check +__u64 u64_encode_bits(u64 v, u64 field) +{ + __assert_field(v, field); + return (v & field_mask(field)) * field_multiplier(field); +} + +static __always_inline __must_check +__u64 u64_replace_bits(__u64 old, u64 val, u64 field) +{ + return (old & ~field) | u64_encode_bits(val, field); +} + +static __always_inline +void u64p_replace_bits(__u64 *p, u64 val, u64 field) +{ + *p = (*p & ~field) | u64_encode_bits(val, field); +} + +static __always_inline __must_check +u64 u64_get_bits(__u64 v, u64 field) +{ + return (v & field) / field_multiplier(field); +} + +#endif /* _LINUX_BITFIELD_FIX_WIDTH_H */ diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h index 14f86e455a67..e3f7315c1d53 100644 --- a/include/linux/bitfield.h +++ b/include/linux/bitfield.h @@ -10,7 +10,7 @@ #include #include #include -#include +#include /* * Bitfield access macros @@ -211,53 +211,6 @@ *(_reg_p) |= (((typeof(_mask))(_val) << __bf_shf(_mask)) & (_mask)); \ }) -extern void __compiletime_error("value doesn't fit into mask") -__field_overflow(void); -extern void __compiletime_error("bad bitfield mask") -__bad_mask(void); -static __always_inline u64 field_multiplier(u64 field) -{ - if ((field | (field - 1)) & ((field | (field - 1)) + 1)) - __bad_mask(); - return field & -field; -} -static __always_inline u64 field_mask(u64 field) -{ - return field / field_multiplier(field); -} -#define field_max(field) ((typeof(field))field_mask(field)) -#define ____MAKE_OP(type,base,to,from) \ -static __always_inline __##type __must_check type##_encode_bits(base v, base field) \ -{ \ - if (__builtin_constant_p(v) && (v & ~field_mask(field))) \ - __field_overflow(); \ - return to((v & field_mask(field)) * field_multiplier(field)); \ -} \ -static __always_inline __##type __must_check type##_replace_bits(__##type old, \ - base val, base field) \ -{ \ - return (old & ~to(field)) | type##_encode_bits(val, field); \ -} \ -static __always_inline void type##p_replace_bits(__##type *p, \ - base val, base field) \ -{ \ - *p = (*p & ~to(field)) | type##_encode_bits(val, field); \ -} \ -static __always_inline base __must_check type##_get_bits(__##type v, base field) \ -{ \ - return (from(v) & field)/field_multiplier(field); \ -} -#define __MAKE_OP(size) \ - ____MAKE_OP(le##size,u##size,cpu_to_le##size,le##size##_to_cpu) \ - ____MAKE_OP(be##size,u##size,cpu_to_be##size,be##size##_to_cpu) \ - ____MAKE_OP(u##size,u##size,,) -____MAKE_OP(u8,u8,,) -__MAKE_OP(16) -__MAKE_OP(32) -__MAKE_OP(64) -#undef __MAKE_OP -#undef ____MAKE_OP - #define __field_prep(mask, val) \ ({ \ auto __mask = (mask); \ diff --git a/tools/include/linux/bitfield-fix-width.h b/tools/include/linux/bitfield-fix-width.h new file mode 100644 index 000000000000..8c2a0fa224e9 --- /dev/null +++ b/tools/include/linux/bitfield-fix-width.h @@ -0,0 +1,236 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef _LINUX_BITFIELD_FIX_WIDTH_H +#define _LINUX_BITFIELD_FIX_WIDTH_H + +#include +#include +#include +#include + +extern void __compiletime_error("value doesn't fit into mask") +__field_overflow(void); + +extern void __compiletime_error("bad bitfield mask") +__bad_mask(void); + +static __always_inline +u64 field_multiplier(u64 field) +{ + if ((field | (field - 1)) & ((field | (field - 1)) + 1)) + __bad_mask(); + return field & -field; +} + +static __always_inline +u64 field_mask(u64 field) +{ + return field / field_multiplier(field); +} + +#define field_max(field) ((typeof(field))field_mask(field)) + +#define __assert_field(v, field) \ + do { \ + if (__builtin_constant_p(v) && \ + ((v) & ~field_mask(field))) \ + __field_overflow(); \ + } while (0) + +static __always_inline +__u8 u8_encode_bits(u8 v, u8 field) +{ + __assert_field(v, field); + return (v & field_mask(field)) * field_multiplier(field); +} + +static __always_inline +__u8 u8_replace_bits(__u8 old, u8 val, u8 field) +{ + return (old & ~field) | u8_encode_bits(val, field); +} + +static __always_inline +void u8p_replace_bits(__u8 *p, u8 val, u8 field) +{ + *p = (*p & ~field) | u8_encode_bits(val, field); +} + +static __always_inline +u8 u8_get_bits(__u8 v, u8 field) +{ + return (v & field) / field_multiplier(field); +} + +static __always_inline +__le16 le16_encode_bits(u16 v, u16 field) +{ + __assert_field(v, field); + return cpu_to_le16((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline +void le16p_replace_bits(__le16 *p, u16 val, u16 field) +{ + *p = (*p & ~cpu_to_le16(field)) | le16_encode_bits(val, field); +} + +static __always_inline +u16 le16_get_bits(__le16 v, u16 field) +{ + return (le16_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline +__be16 be16_encode_bits(u16 v, u16 field) +{ + __assert_field(v, field); + return cpu_to_be16((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline +u16 be16_get_bits(__be16 v, u16 field) +{ + return (be16_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline +__u16 u16_encode_bits(u16 v, u16 field) +{ + __assert_field(v, field); + return (v & field_mask(field)) * field_multiplier(field); +} + +static __always_inline +__u16 u16_replace_bits(__u16 old, u16 val, u16 field) +{ + return (old & ~field) | u16_encode_bits(val, field); +} + +static __always_inline +void u16p_replace_bits(__u16 *p, u16 val, u16 field) +{ + *p = (*p & ~field) | u16_encode_bits(val, field); +} + +static __always_inline +u16 u16_get_bits(__u16 v, u16 field) +{ + return (v & field) / field_multiplier(field); +} + +static __always_inline +__le32 le32_encode_bits(u32 v, u32 field) +{ + __assert_field(v, field); + return cpu_to_le32((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline +void le32p_replace_bits(__le32 *p, u32 val, u32 field) +{ + *p = (*p & ~cpu_to_le32(field)) | le32_encode_bits(val, field); +} + +static __always_inline +u32 le32_get_bits(__le32 v, u32 field) +{ + return (le32_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline +__be32 be32_encode_bits(u32 v, u32 field) +{ + __assert_field(v, field); + return cpu_to_be32((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline +void be32p_replace_bits(__be32 *p, u32 val, u32 field) +{ + *p = (*p & ~cpu_to_be32(field)) | be32_encode_bits(val, field); +} + +static __always_inline +u32 be32_get_bits(__be32 v, u32 field) +{ + return (be32_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline +__u32 u32_encode_bits(u32 v, u32 field) +{ + __assert_field(v, field); + return (v & field_mask(field)) * field_multiplier(field); +} + +static __always_inline +__u32 u32_replace_bits(__u32 old, u32 val, u32 field) +{ + return (old & ~field) | u32_encode_bits(val, field); +} + +static __always_inline +void u32p_replace_bits(__u32 *p, u32 val, u32 field) +{ + *p = (*p & ~field) | u32_encode_bits(val, field); +} + +static __always_inline +u32 u32_get_bits(__u32 v, u32 field) +{ + return (v & field) / field_multiplier(field); +} + +static __always_inline +__le64 le64_encode_bits(u64 v, u64 field) +{ + __assert_field(v, field); + return cpu_to_le64((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline +u64 le64_get_bits(__le64 v, u64 field) +{ + return (le64_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline +__be64 be64_encode_bits(u64 v, u64 field) +{ + __assert_field(v, field); + return cpu_to_be64((v & field_mask(field)) * field_multiplier(field)); +} + +static __always_inline +u64 be64_get_bits(__be64 v, u64 field) +{ + return (be64_to_cpu(v) & field) / field_multiplier(field); +} + +static __always_inline +__u64 u64_encode_bits(u64 v, u64 field) +{ + __assert_field(v, field); + return (v & field_mask(field)) * field_multiplier(field); +} + +static __always_inline +__u64 u64_replace_bits(__u64 old, u64 val, u64 field) +{ + return (old & ~field) | u64_encode_bits(val, field); +} + +static __always_inline +void u64p_replace_bits(__u64 *p, u64 val, u64 field) +{ + *p = (*p & ~field) | u64_encode_bits(val, field); +} + +static __always_inline +u64 u64_get_bits(__u64 v, u64 field) +{ + return (v & field) / field_multiplier(field); +} + +#endif /* _LINUX_BITFIELD_FIX_WIDTH_H */ diff --git a/tools/include/linux/bitfield.h b/tools/include/linux/bitfield.h index ddf81f24956b..4508cefabec9 100644 --- a/tools/include/linux/bitfield.h +++ b/tools/include/linux/bitfield.h @@ -9,7 +9,7 @@ #include #include -#include +#include /* * Bitfield access macros @@ -127,51 +127,4 @@ (typeof(_mask))(((_reg) & (_mask)) >> __bf_shf(_mask)); \ }) -extern void __compiletime_error("value doesn't fit into mask") -__field_overflow(void); -extern void __compiletime_error("bad bitfield mask") -__bad_mask(void); -static __always_inline u64 field_multiplier(u64 field) -{ - if ((field | (field - 1)) & ((field | (field - 1)) + 1)) - __bad_mask(); - return field & -field; -} -static __always_inline u64 field_mask(u64 field) -{ - return field / field_multiplier(field); -} -#define field_max(field) ((typeof(field))field_mask(field)) -#define ____MAKE_OP(type,base,to,from) \ -static __always_inline __##type type##_encode_bits(base v, base field) \ -{ \ - if (__builtin_constant_p(v) && (v & ~field_mask(field))) \ - __field_overflow(); \ - return to((v & field_mask(field)) * field_multiplier(field)); \ -} \ -static __always_inline __##type type##_replace_bits(__##type old, \ - base val, base field) \ -{ \ - return (old & ~to(field)) | type##_encode_bits(val, field); \ -} \ -static __always_inline void type##p_replace_bits(__##type *p, \ - base val, base field) \ -{ \ - *p = (*p & ~to(field)) | type##_encode_bits(val, field); \ -} \ -static __always_inline base type##_get_bits(__##type v, base field) \ -{ \ - return (from(v) & field)/field_multiplier(field); \ -} -#define __MAKE_OP(size) \ - ____MAKE_OP(le##size,u##size,cpu_to_le##size,le##size##_to_cpu) \ - ____MAKE_OP(be##size,u##size,cpu_to_be##size,be##size##_to_cpu) \ - ____MAKE_OP(u##size,u##size,,) -____MAKE_OP(u8,u8,,) -__MAKE_OP(16) -__MAKE_OP(32) -__MAKE_OP(64) -#undef __MAKE_OP -#undef ____MAKE_OP - #endif From d267d2f41222912a5f40dc064df64cee57c8bade Mon Sep 17 00:00:00 2001 From: Mark Brown Date: Wed, 23 Sep 2026 23:09:53 +0100 Subject: [PATCH 02/10] bitfield: Restore be16_replace_bits() Commit 1c88ceb09d5e5 ("bitfield: get rid of __MAKE_OP machinery") removed a bunch of unused bitfield operations including be16_replace_bits() but commit 508bdb4938928 ("iio: adc: Add AD7768 and AD7768-4 core support") introduces a new user. Restore the function so the build still works once both branches are merged. Signed-off-by: Mark Brown Signed-off-by: Yury Norov --- include/linux/bitfield-fix-width.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/linux/bitfield-fix-width.h b/include/linux/bitfield-fix-width.h index fba86bb76999..f73b8cd65601 100644 --- a/include/linux/bitfield-fix-width.h +++ b/include/linux/bitfield-fix-width.h @@ -93,6 +93,12 @@ u16 be16_get_bits(__be16 v, u16 field) return (be16_to_cpu(v) & field) / field_multiplier(field); } +static __always_inline __must_check +__be16 be16_replace_bits(__be16 old, u16 val, u16 field) +{ + return (old & ~cpu_to_be16(field)) | be16_encode_bits(val, field); +} + static __always_inline __must_check __u16 u16_encode_bits(u16 v, u16 field) { From 7cee2fb210a198667d3d4200705215e6f315cab0 Mon Sep 17 00:00:00 2001 From: Shashank Mohan Jain Date: Sat, 26 Sep 2026 06:56:46 +0530 Subject: [PATCH 03/10] bitmap: bitmap_parse(): reject non-hex character before 8 digits bitmap_parse() is documented to return -EINVAL for illegal characters, and it does so everywhere except when the illegal character directly precedes a chunk of exactly eight hex digits. bitmap_get_x32_reverse() parses a chunk from right to left. After it has consumed eight digits it looks at one more character: a hex digit means the chunk is wider than 32 bits and -EOVERFLOW is returned. Any other character is silently consumed as if it were a separator, and the remaining input is parsed as the next chunk. As a result: "x12345678" -> 0x12345678, returns 0 (expected -EINVAL) "1g12345678" -> 0x1_12345678, returns 0 (expected -EINVAL) "0x0000000f" -> 0xf, returns 0, while "0xf" returns -EINVAL bitmap_parse() backs cpumask_parse() and cpumask_parse_user(), so the same inconsistency is visible when writing masks such as /proc/irq/*/smp_affinity or the network queue rps_cpus/xps_cpus files. __bitmap_parse(), which this function replaced in commit 2d6261583be0 ("lib: rework bitmap_parse()"), rejected all three strings with -EINVAL, and a "0x" prefix is accepted today only when exactly eight digits follow it, so no reliably working input is lost. When the loop falls through, *end is known to be a non-separator character inside the buffer, so return -EOVERFLOW if it is a hex digit and -EINVAL otherwise. Fixes: 2d6261583be0 ("lib: rework bitmap_parse()") Assisted-by: LLM Signed-off-by: Shashank Mohan Jain Signed-off-by: Yury Norov --- lib/bitmap-str.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/bitmap-str.c b/lib/bitmap-str.c index dd9aa0635fa5..e02c5bc80951 100644 --- a/lib/bitmap-str.c +++ b/lib/bitmap-str.c @@ -414,8 +414,12 @@ static const char *bitmap_get_x32_reverse(const char *start, goto out; } - if (hex_to_bin(*end--) >= 0) - return ERR_PTR(-EOVERFLOW); + /* + * Eight digits have been consumed and the next character is not a + * separator: another hex digit means the chunk does not fit in 32 + * bits, anything else is an illegal character. + */ + return ERR_PTR(hex_to_bin(*end) >= 0 ? -EOVERFLOW : -EINVAL); out: *num = ret; return end; From bf7e3cb42c8b5d52fa4232c11bae40e9a2509f95 Mon Sep 17 00:00:00 2001 From: Shashank Mohan Jain Date: Sat, 26 Sep 2026 06:56:47 +0530 Subject: [PATCH 04/10] bitmap: test bitmap_parse() with an illegal character before 8 hex digits Add bitmap_parse() cases where an illegal character directly precedes a chunk of eight hex digits. These were accepted before the previous patch and must return -EINVAL. Assisted-by: LLM Signed-off-by: Shashank Mohan Jain Signed-off-by: Yury Norov --- lib/test_bitmap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/test_bitmap.c b/lib/test_bitmap.c index 56bd23059b26..35bb18f6e326 100644 --- a/lib/test_bitmap.c +++ b/lib/test_bitmap.c @@ -643,6 +643,10 @@ static const struct test_bitmap_parselist parse_tests[] __initconst = { {-EOVERFLOW, "badf00d,deadbeef,1,0", NULL, 90, 0}, {-EOVERFLOW, "fbadf00d,deadbeef,1,0", NULL, 95, 0}, {-EOVERFLOW, "badf00d,deadbeef,1,0", NULL, 100, 0}, + + {-EINVAL, "x12345678", NULL, 32, 0}, + {-EINVAL, "1g12345678", NULL, 64, 0}, + {-EINVAL, "0x0000000f", NULL, 64, 0}, #undef step }; From c55d102257fa31271c6f11fea595b78c48fd7aa2 Mon Sep 17 00:00:00 2001 From: Shashank Mohan Jain Date: Sat, 26 Sep 2026 06:56:48 +0530 Subject: [PATCH 05/10] bitmap: bitmap_parselist(): reject trailing characters after group size bitmap_parse_region() checks that every region ends at a separator (',', whitespace, '\n' or '\0'), except in the "range:used/group" form: after parsing the group size it returns the pointer to the following character without looking at it. The caller then starts a new region at that character. Before 'N' and 'all' were accepted as region starts this happened to be harmless, because any other character would fail to parse as a new region. Now text directly following the group size is silently parsed as another region: "0-7:1/2N" -> bits 0,2,4,6,7 (nbits = 8), returns 0 "0-7:1/2all" -> all bits set, returns 0 while "0-7N", "5N" or "0-7:1/2x" are correctly rejected with -EINVAL. bitmap_parselist() is documented to return -EINVAL for an invalid character. It parses cpu lists from sysfs, cgroup cpuset files and boot parameters such as isolcpus= and nohz_full=, so a typo there is accepted and yields a different mask than intended. Check for the end of the region after the group size as well, like the other forms do. Fixes: 2c4885d24e64 ("lib: bitmap: support "N" as an alias for size of bitmap") Assisted-by: LLM Signed-off-by: Shashank Mohan Jain Signed-off-by: Yury Norov --- lib/bitmap-str.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/lib/bitmap-str.c b/lib/bitmap-str.c index e02c5bc80951..b58966864657 100644 --- a/lib/bitmap-str.c +++ b/lib/bitmap-str.c @@ -299,7 +299,14 @@ static const char *bitmap_parse_region(const char *str, struct region *r) if (*str != '/') return ERR_PTR(-EINVAL); - return bitmap_getnum(str + 1, &r->group_len, lastbit); + str = bitmap_getnum(str + 1, &r->group_len, lastbit); + if (IS_ERR(str)) + return str; + + if (!end_of_region(*str)) + return ERR_PTR(-EINVAL); + + return end_of_str(*str) ? NULL : str; no_end: r->end = r->start; From f2c318d812f9b108c4808342ea135e2788c5fd6e Mon Sep 17 00:00:00 2001 From: Shashank Mohan Jain Date: Sat, 26 Sep 2026 06:56:49 +0530 Subject: [PATCH 06/10] bitmap: test bitmap_parselist() with text after the group size Add bitmap_parselist() cases where 'N' or 'all' directly follows the group size of a "range:used/group" region. These were accepted before "bitmap: bitmap_parselist(): reject trailing characters after group size" and must return -EINVAL. Assisted-by: LLM Signed-off-by: Shashank Mohan Jain Signed-off-by: Yury Norov --- lib/test_bitmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/test_bitmap.c b/lib/test_bitmap.c index 35bb18f6e326..f316a82840f5 100644 --- a/lib/test_bitmap.c +++ b/lib/test_bitmap.c @@ -528,6 +528,9 @@ static const struct test_bitmap_parselist parselist_tests[] __initconst = { {-EINVAL, "a-31:10/1", NULL, 8, 0}, {-EINVAL, "0-31:a/1", NULL, 8, 0}, {-EINVAL, "0-\n", NULL, 8, 0}, + {-EINVAL, "0-7:1/2N", NULL, 8, 0}, + {-EINVAL, "0-7:1/2all", NULL, 8, 0}, + {-EINVAL, "all:1/2N", NULL, 8, 0}, }; From d075c4dc0b3c8ed91a4f67ebdf3384aa59fd4fbb Mon Sep 17 00:00:00 2001 From: Shashank Mohan Jain Date: Sat, 26 Sep 2026 06:56:50 +0530 Subject: [PATCH 07/10] bitmap: bitmap_parselist(): don't wrap around on a huge group size In the "range:used/group" form bitmap_set_region() walks the range with for (start = r->start; start <= r->end; start += r->group_len) where all values are unsigned int. bitmap_getnum() accepts any group size up to UINT_MAX, and bitmap_check_region() only requires it to be non-zero and at least the used size. If start + group_len exceeds UINT_MAX, start wraps around to a small value that is still <= end, and bits below the start of the range get set: "1-1:1/4294967295" -> bits 0,1 (expected bit 1) "15-15:1/4294967281" -> bits 0,15 (expected bit 15) The loop still terminates, because start keeps decreasing until it wraps past zero again, but the resulting mask contains bits outside the requested range. This needs a group size within 'start' of UINT_MAX, so it is unlikely to be hit by accident; all bits set stay below the end of the range, so there is no out-of-bounds write. A group larger than the range simply means that the range contains a single group, so stop the walk when the next group would start beyond UINT_MAX. Fixes: 0a5ce0831d04 ("lib/bitmap.c: make bitmap_parselist() thread-safe and much faster") Assisted-by: LLM Signed-off-by: Shashank Mohan Jain Signed-off-by: Yury Norov --- lib/bitmap-str.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lib/bitmap-str.c b/lib/bitmap-str.c index b58966864657..cafd6388892f 100644 --- a/lib/bitmap-str.c +++ b/lib/bitmap-str.c @@ -8,6 +8,7 @@ #include #include #include +#include #include #include "kstrtox.h" @@ -186,10 +187,12 @@ struct region { static void bitmap_set_region(const struct region *r, unsigned long *bitmap) { - unsigned int start; + unsigned int start = r->start; - for (start = r->start; start <= r->end; start += r->group_len) + do { bitmap_set(bitmap, start, min(r->end - start + 1, r->off)); + } while (!check_add_overflow(start, r->group_len, &start) && + start <= r->end); } static int bitmap_check_region(const struct region *r) From 452a6d5b5e0556848a8c28428c8f86874ea4ee02 Mon Sep 17 00:00:00 2001 From: Shashank Mohan Jain Date: Sat, 26 Sep 2026 06:56:51 +0530 Subject: [PATCH 08/10] bitmap: test bitmap_parselist() with a group size close to UINT_MAX Add bitmap_parselist() cases where the group size makes start + group_len overflow an unsigned int. Before "bitmap: bitmap_parselist(): don't wrap around on a huge group size" the region walk wrapped around and also set bit 0. Assisted-by: LLM Signed-off-by: Shashank Mohan Jain Signed-off-by: Yury Norov --- lib/test_bitmap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/test_bitmap.c b/lib/test_bitmap.c index f316a82840f5..ba09d057f47f 100644 --- a/lib/test_bitmap.c +++ b/lib/test_bitmap.c @@ -502,6 +502,8 @@ static const struct test_bitmap_parselist parselist_tests[] __initconst = { {0, "0-N:1/3,1-N:1/3,2-N:1/3", &exp1[8 * step], 32, 0}, {0, "0-31:1/3,1-31:1/3,2-31:1/3", &exp1[8 * step], 32, 0}, {0, "1-10:8/12,8-31:24/29,0-31:0/3", &exp1[9 * step], 32, 0}, + {0, "1-1:1/4294967295", &exp1[1 * step], 32, 0}, + {0, "15-15:1/4294967281", &exp1[13 * step], 32, 0}, {0, "all", &exp1[8 * step], 32, 0}, {0, "0, 1, all, ", &exp1[8 * step], 32, 0}, From 842c5beca0b369bb143b86d6ae63dbcd7c5f0988 Mon Sep 17 00:00:00 2001 From: Georgios Androutsopoulos Date: Tue, 8 Sep 2026 16:31:57 -0400 Subject: [PATCH 09/10] rust: id_pool: document panics in `find_unused_id` and `release_id` `find_unused_id()` calls `Bitmap::next_zero_bit()` and `release_id()` calls `Bitmap::clear_bit()`, both of which panic when `CONFIG_RUST_BITMAP_HARDENED` is enabled and the index is out of bounds. Neither `IdPool` method documents this. Add the missing `# Panics` sections and state the bounds requirement on `offset` and `id`. Fixes: 2cdae413cd3e ("rust: add dynamic ID pool abstraction for bitmap") Reviewed-by: Alexandre Courbot Signed-off-by: Georgios Androutsopoulos Signed-off-by: Yury Norov --- rust/kernel/id_pool.rs | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/rust/kernel/id_pool.rs b/rust/kernel/id_pool.rs index 384753fe0e44..c8b346554802 100644 --- a/rust/kernel/id_pool.rs +++ b/rust/kernel/id_pool.rs @@ -224,7 +224,13 @@ pub fn grow(&mut self, mut resizer: PoolResizer) { /// Finds an unused ID in the bitmap. /// /// Upon success, returns its index. Otherwise, returns [`None`] - /// to indicate that a [`Self::grow_request`] is needed. + /// to indicate that a [`Self::grow_request`] is needed. `offset` must be + /// within bounds. + /// + /// # Panics + /// + /// Panics if `CONFIG_RUST_BITMAP_HARDENED` is enabled and `offset` is out + /// of bounds. #[inline] #[must_use] pub fn find_unused_id(&mut self, offset: usize) -> Option> { @@ -236,6 +242,13 @@ pub fn find_unused_id(&mut self, offset: usize) -> Option> { } /// Releases an ID. + /// + /// The `id` must be within bounds. + /// + /// # Panics + /// + /// Panics if `CONFIG_RUST_BITMAP_HARDENED` is enabled and `id` is out of + /// bounds. #[inline] pub fn release_id(&mut self, id: usize) { self.map.clear_bit(id); From a73b4d1fa7d334a5f7de5bb0a14726530f66196e Mon Sep 17 00:00:00 2001 From: Georgios Androutsopoulos Date: Tue, 8 Sep 2026 16:13:02 -0400 Subject: [PATCH 10/10] rust: bitmap: document panics in `next_bit` and `next_zero_bit` `next_bit()` and `next_zero_bit()` use `bitmap_assert!()` to check that `start` is less than `self.len()`, which panics when `CONFIG_RUST_BITMAP_HARDENED` is enabled. However, neither function has a `# Panics` section, and both document that `None` is returned for exactly the input that triggers the panic. Update the documentation of `next_bit()` and `next_zero_bit()` to add the missing `# Panics` sections, add the missing blank doc comment line before `Returns` in `next_zero_bit()`, and simplify the wording. Fixes: 11eca92a2cae ("rust: add bitmap API.") Closes: https://github.com/Rust-for-Linux/linux/issues/1252 Reviewed-by: Alexandre Courbot Signed-off-by: Georgios Androutsopoulos Signed-off-by: Yury Norov --- rust/kernel/bitmap.rs | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/rust/kernel/bitmap.rs b/rust/kernel/bitmap.rs index b27e0ec80d64..b51c8a96f1a8 100644 --- a/rust/kernel/bitmap.rs +++ b/rust/kernel/bitmap.rs @@ -459,7 +459,13 @@ pub fn last_bit(&self) -> Option { /// Finds next set bit, starting from `start`. /// - /// Returns `None` if `start` is greater or equal to `self.nbits`. + /// Returns `None` if no bits are set on or after the given index. The + /// index `start` must be in bounds. + /// + /// # Panics + /// + /// Panics if `CONFIG_RUST_BITMAP_HARDENED` is enabled and `start` is + /// out of bounds. #[inline] pub fn next_bit(&self, start: usize) -> Option { bitmap_assert!( @@ -479,7 +485,14 @@ pub fn next_bit(&self, start: usize) -> Option { } /// Finds next zero bit, starting from `start`. - /// Returns `None` if `start` is greater than or equal to `self.len()`. + /// + /// Returns `None` if no bits are zero on or after the given index. The + /// index `start` must be in bounds. + /// + /// # Panics + /// + /// Panics if `CONFIG_RUST_BITMAP_HARDENED` is enabled and `start` is + /// out of bounds. #[inline] pub fn next_zero_bit(&self, start: usize) -> Option { bitmap_assert!(