Messages in this thread | | | Date | Mon, 20 Oct 2014 16:09:30 +0200 | From | Daniel Borkmann <> | Subject | Re: drivers: random: Shift out-of-bounds in _mix_pool_bytes |
| |
On 10/20/2014 03:58 PM, Andrey Ryabinin wrote: > On 10/20/2014 04:49 PM, Theodore Ts'o wrote: >> On Mon, Oct 20, 2014 at 03:03:22PM +0400, Andrey Ryabinin wrote: >>> Hi, Theodore. >>> >>> I've got this while booting kernel with ubsan: >>> >>> [ 0.000000] ================================================================================ >>> [ 0.000000] UBSan: Undefined behaviour in ../include/linux/bitops.h:107:33 >>> [ 0.000000] shift exponent 32 is to large for 32-bit type 'unsigned int' >> ... >>> [ 0.000000] _mix_pool_bytes (/home/andrew/linux/ubsan_x86//include/linux/bitopsh:107 /home/andrew/linux/ubsan_x86//drivers/char/randomc:509) >> >> So this doesn't make any sense to me. This is triggering here: >> >> w = rol32(*bytes++, input_rotate); >> >> .... but input_rotate should never be >= 32, since it is set this way: >> > > It's triggering when input_rotate == 0, so UBSan complains about right shift in rol32() > > static inline __u32 rol32(__u32 word, unsigned int shift) > { > return (word << shift) | (word >> (32 - shift)); > }
So that would be the case when the entropy store's input_rotate calls _mix_pool_bytes() for the very first time ... I don't think it's an issue though.
| |