From: Yiyuan guo <yguoaz@gmail.com>
To: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"andy@kernel.org" <andy@kernel.org>,
"tpiepho@gmail.com" <tpiepho@gmail.com>,
"akpm@linux-foundation.org" <akpm@linux-foundation.org>,
"oskar@scara.com" <oskar@scara.com>
Subject: Re: A divide by zero bug in lib/math/rational.c (with triggering input)
Date: Fri, 21 May 2021 15:55:03 +0800 [thread overview]
Message-ID: <CAM7=BFoH7Q+YHvPFnHM4j72ORHQp4gTjHFjnfeLsV2-30ZLNYw@mail.gmail.com> (raw)
In-Reply-To: <CAHp75Vft8pnA+m0C=Ok7nRyjERAd2uJJ4q6HcN460j0Hir6Kaw@mail.gmail.com>
Thanks for your timely response.
I am not familiar with the theorem. But any input satisfying the
condition below will
trigger a divide by zero at the first loop iteration:
(given_numerator / given_denominator > max_numerator) || (1 +
given_numerator / given_denominator > max_denominator)
I think such a condition is rather complex and may not be enforced by
all callers of this function.
On Fri, May 21, 2021 at 3:42 PM Andy Shevchenko
<andy.shevchenko@gmail.com> wrote:
>
>
>
> On Friday, May 21, 2021, Andy Shevchenko <andy.shevchenko@gmail.com> wrote:
>>
>>
>>
>> On Friday, May 21, 2021, Yiyuan guo <yguoaz@gmail.com> wrote:
>>>
>>> In the file lib/math/rational.c, the function
>>> rational_best_approximation has the following
>>> code:
>>>
>>> void rational_best_approximation(
>>> unsigned long given_numerator, unsigned long given_denominator,
>>> unsigned long max_numerator, unsigned long max_denominator,
>>> unsigned long *best_numerator, unsigned long *best_denominator) {
>>> ...
>>> if ((n2 > max_numerator) || (d2 > max_denominator)) {
>>> unsigned long t = min((max_numerator - n0) / n1,
>>> (max_denominator - d0) / d1);
>>> ...
>>> }
>>>
>>> d1 may be equal to zero when performing the division, leading to a
>>> divide by zero problem.
>>>
>>> One input to trigger the divide by zero bug is:
>>> rational_best_approximation(31415, 100, (1 << 8) - 1, (1 << 5) - 1, &n, &d)
>>
>>
>>
>> Have you read a theorem about this? TL;DR; as far as I can see the input data is not suitable for this function.
>>
>
>
> I think we may add the proper check and saturate the output which in your case should be (255,1).
>
>>
>>
>> --
>> With Best Regards,
>> Andy Shevchenko
>>
>>
>
>
> --
> With Best Regards,
> Andy Shevchenko
>
>
next prev parent reply other threads:[~2021-05-21 7:55 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-21 5:09 A divide by zero bug in lib/math/rational.c (with triggering input) Yiyuan guo
[not found] ` <CAHp75Vf8kQ73w0R9ieDNjDVkxM-V83QRN9mc6BjRZA8xHpPNAA@mail.gmail.com>
[not found] ` <CAHp75Vft8pnA+m0C=Ok7nRyjERAd2uJJ4q6HcN460j0Hir6Kaw@mail.gmail.com>
2021-05-21 7:55 ` Yiyuan guo [this message]
2021-05-21 9:20 ` Trent Piepho
2021-05-21 9:53 ` Andy Shevchenko
2021-05-22 19:07 ` Oskar Schirmer
2021-05-24 3:20 ` Trent Piepho
2021-05-23 0:05 ` Trent Piepho
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAM7=BFoH7Q+YHvPFnHM4j72ORHQp4gTjHFjnfeLsV2-30ZLNYw@mail.gmail.com' \
--to=yguoaz@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=andy.shevchenko@gmail.com \
--cc=andy@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=oskar@scara.com \
--cc=tpiepho@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).