Re: drivers: random: Shift out-of-bounds in _mix_pool_bytes
From: Daniel Borkmann
Date: Mon Oct 20 2014 - 10:10:30 EST
On 10/20/2014 03:58 PM, Andrey Ryabinin wrote:
On 10/20/2014 04:49 PM, Theodore Ts'o wrote:
On Mon, Oct 20, 2014 at 03:03:22PM +0400, Andrey Ryabinin wrote:
Hi, Theodore.
I've got this while booting kernel with ubsan:
[ 0.000000] ================================================================================
[ 0.000000] UBSan: Undefined behaviour in ../include/linux/bitops.h:107:33
[ 0.000000] shift exponent 32 is to large for 32-bit type 'unsigned int'
...
[ 0.000000] _mix_pool_bytes (/home/andrew/linux/ubsan_x86//include/linux/bitopsh:107 /home/andrew/linux/ubsan_x86//drivers/char/randomc:509)
So this doesn't make any sense to me. This is triggering here:
w = rol32(*bytes++, input_rotate);
.... but input_rotate should never be >= 32, since it is set this way:
It's triggering when input_rotate == 0, so UBSan complains about right shift in rol32()
static inline __u32 rol32(__u32 word, unsigned int shift)
{
return (word << shift) | (word >> (32 - shift));
}
So that would be the case when the entropy store's input_rotate calls
_mix_pool_bytes() for the very first time ... I don't think it's an
issue though.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/