[tip: timers/vdso] vdso/gettimeofday: Assert that the clockid fits into the u32 bitmask

[tip-bot2 for Zhan Xusheng]

The following commit has been merged into the timers/vdso branch of tip:

Commit-ID:     40b7421a2e85e8d2a4cd1f81939274b397aa4b1b
Gitweb:        https://git.kernel.org/tip/40b7421a2e85e8d2a4cd1f81939274b397aa4b1b
Author:        Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
AuthorDate:    Fri, 16 Oct 2026 23:32:12 +08:00
Committer:     Thomas Gleixner <tglx@xxxxxxxxxx>
CommitterDate: Mon, 09 Nov 2026 16:23:37 +01:00

vdso/gettimeofday: Assert that the clockid fits into the u32 bitmask

__cvdso_clock_gettime_common() and __cvdso_clock_getres_common() turn the
clockid into a bitmask:

	msk = 1U << clock;

The shift count stays in range because vdso_clockid_valid() rejects
anything above CLOCK_AUX_LAST, which is 23.  Nothing records that, so
raising MAX_AUX_CLOCKS past 16 would take CLOCK_AUX_LAST to 32 and make
the shift undefined.

Assert it in vdso_clockid_valid(), which is where the bound comes from
and covers both conversion sites.

8 * sizeof(u32) rather than BITS_PER_TYPE(): the latter lives in
linux/bits.h, which lib/vdso/gettimeofday.c only reaches on
architectures whose asm/vdso/gettimeofday.h happens to pull it in.

MAX_AUX_CLOCKS=16 still builds, 17 trips the assert.

Suggested-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
Link: https://patch.msgid.link/20261016153212.2733798-1-zhanxusheng1024@xxxxxxxxx
---
 lib/vdso/gettimeofday.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/vdso/gettimeofday.c b/lib/vdso/gettimeofday.c
index a324b2f..67c9bcd 100644
--- a/lib/vdso/gettimeofday.c
+++ b/lib/vdso/gettimeofday.c
@@ -99,6 +99,12 @@ static __always_inline const struct vdso_time_data *__arch_get_vdso_u_time_data(
 
 static __always_inline bool vdso_clockid_valid(clockid_t clock)
 {
+	/*
+	 * The callers turn an accepted clockid into a bitmask with
+	 * 1U << clock, so the largest one has to fit into that u32.
+	 */
+	BUILD_BUG_ON(CLOCK_AUX_LAST >= 8 * sizeof(u32));
+
 	/* Check for negative values or invalid clocks */
 	return likely((u32) clock <= CLOCK_AUX_LAST);
 }