Re: drivers: random: Shift out-of-bounds in _mix_pool_bytes

[H. Peter Anvin]

On 10/24/2014 03:09 PM, Andreas Dilger wrote:
> On Oct 24, 2014, at 9:10 AM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
>> On Fri, Oct 24, 2014 at 7:04 PM, Sasha Levin <sasha.levin@xxxxxxxxxx> wrote:
>>> On 10/24/2014 09:42 AM, Peter Zijlstra wrote:
>>>> On Fri, Oct 24, 2014 at 09:23:35AM -0400, Sasha Levin wrote:
>>>>>
>>>>> i >> 32 may happen to be "i", but is there anything that prevents the compiler from returning, let's say, 42?
>>>>
>>>> Not really, although gcc seems to opt for the 'sane' option and emit
>>>> the instruction and let the arch figure out how to deal with it. 
>>>> Hence the 'fun' difference between x86 and ARM.
>>>
>>> It's interesting how many different views on undefined behaviour there are between kernel folks. 
>>>
>>> Everything between Ted Ts'o saying that GCC can launch nethack on oversized shifts, to DaveM saying he will file a GCC bug if the
>>> behaviour isn't sane w.r.t to memcpy().
>>
>> One of the benefits of fixing such issues (or not letting them into
>> code in the first place) is just saving numerous hours of top-notch
>> engineers spent on disputes like this.
> 
> By the principle of least surprise, I would expect "__u32 >> N", where
> N >= 32 to return zero instead of random garbage.  For N < 32 it will
> return progressively smaller numbers, until it has shifted away all of
> the set bits, at which turn it will return 0.  For it suddenly to jump
> up once N = 32 is used, is counter-intuitive.
> 

That's why it is undefined.

	-hpa


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/