Re: [PATCH 1/1] lib/random.c fix undefined behavior on signed integer overflow.

["Darrick J. Wong" <djwong@kernel.org>]

On Tue, Oct 06, 2026 at 03:51:52PM +0200, Lukas Herbolt wrote:
> The random.c now expects that signed integer to overflow and
> triggers the  ^MASK branch. But signed int overflow is undefined
> behavior and GCC can optimize this branch out with certain
> CFLAGS/LDFLAGS.
> 
> Signed-off-by: Lukas Herbolt <lukas@herbolt.com>
> ---
>  lib/random.c | 13 +++++++------
>  1 file changed, 7 insertions(+), 6 deletions(-)
> 
> diff --git a/lib/random.c b/lib/random.c
> index d5c81be817c8..f767ed1d1337 100644
> --- a/lib/random.c
> +++ b/lib/random.c
> @@ -186,14 +186,15 @@ _random (int32_t is [2])
>  int32_t 
>  _irandm (int32_t is [2])
>  {
> -	int32_t it, leh, nit;
> -
> +	int32_t it, leh, nit, apply_mask;
>  	it = is [0];
>  	leh = is [1];
> -	if (it <= 0)	
> -		it = (it + it) ^ MASK;
> -	else
> -		it = it + it;
> +
> +/* 	evaluate on original value — no UB here */
> +	apply_mask = (it <= 0);
> +/*	double via unsigned shift — well-defined */
> +	it = (unsigned)it << 1;
> +	if (apply_mask) it ^= MASK;

Doesn't _random suffer the same flaw?

Oh.  It's dead code, maybe it should go away?

Also, what about converting all the variables to unsigned?

--D

>  	nit = it - 1;
>  /*	to ensure all-ones pattern omitted    */
>  	leh = leh * mt[nit & 127] + nit;
> -- 
> 2.55.0
> 
>