Re: drivers: random: Shift out-of-bounds in _mix_pool_bytes

[Theodore Ts'o]

On Mon, Oct 20, 2014 at 04:09:30PM +0200, Daniel Borkmann wrote:
> >
> >It's triggering when input_rotate == 0, so UBSan complains about right shift in rol32()
> >
> >static inline __u32 rol32(__u32 word, unsigned int shift)
> >{
> >	return (word << shift) | (word >> (32 - shift));
> >}
> 
> So that would be the case when the entropy store's input_rotate calls
> _mix_pool_bytes() for the very first time ... I don't think it's an
> issue though.

I'm sure it's not an issue, but it's still true that 

	return (word << 0) | (word >> 32);

is technically not undefined, and while it would be unfortunate (and
highly unlikely) if gcc were to say, start nethack, it's technically
allowed by the C spec.  :-)

     	     	   	    	 	     - Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/