Re: [PATCH v7 06/20] KVM: selftests: Add helper to generate random u64 in range [min,max]

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The generic PRNG helper `kvm_random_u64_in_range()` is fundamentally incapable of generating values in large portions of the requested range due to the structural limitations of the underlying generator.
--

commit 9b7095f015b8aad9cb0b24b2b051b56cd3917145
Author: Josh Hilke <jrhilke@google.com>

KVM: selftests: Add helper to generate random u64 in range [min,max]

Introduce kvm_random_u64_in_range(state, min, max) to return a random u64 in
the inclusive range of [min, max] using a struct kvm_random_state.

> diff --git a/tools/testing/selftests/kvm/lib/test_util.c b/tools/testing/selftests/kvm/lib/test_util.c
> index e98ca7ef439c4..e208a57f190cf 100644
> --- a/tools/testing/selftests/kvm/lib/test_util.c
> +++ b/tools/testing/selftests/kvm/lib/test_util.c
> @@ -42,6 +42,24 @@ u32 kvm_random_u32(struct kvm_random_state *state)
>  	return state->seed;
>  }
>  
> +/* Returns a random u64 in the inclusive range [min, max] */
> +u64 kvm_random_u64_in_range(struct kvm_random_state *state, u64 min,
> +			    u64 max)
> +{
> +	u64 value;
> +	u64 range;
> +
> +	TEST_ASSERT(min <= max, "PEBKAC, min = 0x%lx, max = 0x%lx", min, max);
> +
> +	value = kvm_random_u64(state);
> +
> +	range = max - min;
> +	if (range == ULLONG_MAX)
> +		return value;

[Severity: Medium]
Can this regression cause tests to silently miss important edge cases?

Since kvm_random_u32() uses a linear congruential generator modulo 0x7FFFFFFF,
its 31st bit is permanently 0, and it never returns 0.

Because kvm_random_u64() concatenates two such values:

tools/testing/selftests/kvm/include/test_util.h:kvm_random_u64() {
	return ((u64)kvm_random_u32(state) << 32) | kvm_random_u32(state);
}

bits 31 and 63 of the resulting 64-bit number are permanently 0, and the lower
32 bits are never 0.

When this is called with a large range like min = 0 and max = ULLONG_MAX, it
directly returns this 64-bit value. Thus, it can never generate numbers above
0x7FFFFFFE7FFFFFFE, any numbers with bit 31 or 63 set, or any numbers below
2^32.

Does this give a false illusion of full mathematical coverage for randomized
inputs?

> +
> +	return min + (value % (range + 1));
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260613002031.745413-1-seanjc@google.com?part=6