Re: drivers: random: Shift out-of-bounds in _mix_pool_bytes

[Andreas Dilger]

On Oct 24, 2014, at 9:10 AM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
> On Fri, Oct 24, 2014 at 7:04 PM, Sasha Levin <sasha.levin@xxxxxxxxxx> wrote:
>> On 10/24/2014 09:42 AM, Peter Zijlstra wrote:
>>> On Fri, Oct 24, 2014 at 09:23:35AM -0400, Sasha Levin wrote:
>>>> 
>>>> i >> 32 may happen to be "i", but is there anything that prevents the compiler from returning, let's say, 42?
>>> 
>>> Not really, although gcc seems to opt for the 'sane' option and emit
>>> the instruction and let the arch figure out how to deal with it. 
>>> Hence the 'fun' difference between x86 and ARM.
>> 
>> It's interesting how many different views on undefined behaviour there are between kernel folks. 
>> 
>> Everything between Ted Ts'o saying that GCC can launch nethack on oversized shifts, to DaveM saying he will file a GCC bug if the
>> behaviour isn't sane w.r.t to memcpy().
> 
> One of the benefits of fixing such issues (or not letting them into
> code in the first place) is just saving numerous hours of top-notch
> engineers spent on disputes like this.

By the principle of least surprise, I would expect "__u32 >> N", where
N >= 32 to return zero instead of random garbage.  For N < 32 it will
return progressively smaller numbers, until it has shifted away all of
the set bits, at which turn it will return 0.  For it suddenly to jump
up once N = 32 is used, is counter-intuitive.

Cheers, Andreas

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail