[PATCH RESEND] vdso/gettimeofday: Assert that the clockid fits into the u32 bitmask

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>

__cvdso_clock_gettime_common() and __cvdso_clock_getres_common() turn the
clockid into a bitmask:

	msk = 1U << clock;

The shift count stays in range because vdso_clockid_valid() rejects
anything above CLOCK_AUX_LAST, which is 23.  Nothing records that, so
raising MAX_AUX_CLOCKS past 16 would take CLOCK_AUX_LAST to 32 and make
the shift undefined.

Assert it in vdso_clockid_valid(), which is where the bound comes from
and covers both conversion sites.

8 * sizeof(u32) rather than BITS_PER_TYPE(): the latter lives in
linux/bits.h, which lib/vdso/gettimeofday.c only reaches on
architectures whose asm/vdso/gettimeofday.h happens to pull it in.

MAX_AUX_CLOCKS=16 still builds, 17 trips the assert.

Suggested-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
---
Resending since 7.4-rc1 is out. This replaces v7 5/5 of

  https://lore.kernel.org/all/20261002153104.1347978-1-zhanxusheng@xxxxxxxxxx/

1-3 of that series are in 7.4-rc1; 4/5 is no longer needed. It now
asserts on CLOCK_AUX_LAST in vdso_clockid_valid(), as suggested.

 lib/vdso/gettimeofday.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/vdso/gettimeofday.c b/lib/vdso/gettimeofday.c
index a324b2f2ec6c..67c9bcdd9aeb 100644
--- a/lib/vdso/gettimeofday.c
+++ b/lib/vdso/gettimeofday.c
@@ -99,6 +99,12 @@ static __always_inline const struct vdso_time_data *__arch_get_vdso_u_time_data(
 
 static __always_inline bool vdso_clockid_valid(clockid_t clock)
 {
+	/*
+	 * The callers turn an accepted clockid into a bitmask with
+	 * 1U << clock, so the largest one has to fit into that u32.
+	 */
+	BUILD_BUG_ON(CLOCK_AUX_LAST >= 8 * sizeof(u32));
+
 	/* Check for negative values or invalid clocks */
 	return likely((u32) clock <= CLOCK_AUX_LAST);
 }
-- 
2.43.0