Skip to content
  • Paul E. McKenney's avatar
    jiffies: Avoid undefined behavior from signed overflow · 5a581b36
    Paul E. McKenney authored
    
    
    According to the C standard 3.4.3p3, overflow of a signed integer results
    in undefined behavior.  This commit therefore changes the definitions
    of time_after(), time_after_eq(), time_after64(), and time_after_eq64()
    to avoid this undefined behavior.  The trick is that the subtraction
    is done using unsigned arithmetic, which according to 6.2.5p9 cannot
    overflow because it is defined as modulo arithmetic.  This has the added
    (though admittedly quite small) benefit of shortening four lines of code
    by four characters each.
    
    Note that the C standard considers the cast from unsigned to
    signed to be implementation-defined, see 6.3.1.3p3.  However, on a
    two's-complement system, an implementation that defines anything other
    than a reinterpretation of the bits is free to come to me, and I will be
    happy to act as a witness for its being committed to an insane asylum.
    (Although I have nothing against saturating arithmetic or signals in some
    cases, these things really should not be the default when compiling an
    operating-system kernel.)
    
    Signed-off-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: John Stultz <john.stultz@linaro.org>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: Kevin Easton <kevin@guarana.org>
    [ paulmck: Included time_after64() and time_after_eq64(), as suggested
      by Eric Dumazet, also fixed commit message.]
    Reviewed-by: default avatarJosh Triplett <josh@joshtriplett.org>
    5a581b36