1 files changed, 10 insertions, 11 deletions

diff --git a/drivers/char/random.c b/drivers/char/random.c
index a754132336ba..ba0d70305384 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -454,7 +454,7 @@ static void __add_entropy_words(struct entropy_store *r, const __u32 *in,
         static __u32 const twist_table[8] = {
                 0x00000000, 0x3b6e20c8, 0x76dc4190, 0x4db26158,
                 0xedb88320, 0xd6d6a3e8, 0x9b64c2b0, 0xa00ae278 };
-        unsigned long i, add_ptr, tap1, tap2, tap3, tap4, tap5;
+        unsigned long i, j, tap1, tap2, tap3, tap4, tap5;
         int input_rotate;
         int wordmask = r->poolinfo->poolwords - 1;
         __u32 w;
@@ -469,19 +469,21 @@ static void __add_entropy_words(struct entropy_store *r, const __u32 *in,
 
         spin_lock_irqsave(&r->lock, flags);
         input_rotate = r->input_rotate;
-        add_ptr = r->add_ptr;
+        i = r->add_ptr;
 
         while (nwords--) {
                 w = rol32(*in++, input_rotate & 31);
-                i = add_ptr = (add_ptr - 1) & wordmask;
+                i = (i - 1) & wordmask;
 
                 /* XOR in the various taps */
+                w ^= r->pool[i];
                 w ^= r->pool[(i + tap1) & wordmask];
                 w ^= r->pool[(i + tap2) & wordmask];
                 w ^= r->pool[(i + tap3) & wordmask];
                 w ^= r->pool[(i + tap4) & wordmask];
                 w ^= r->pool[(i + tap5) & wordmask];
-                w ^= r->pool[i];
+
+                /* Mix the result back in with a twist */
                 r->pool[i] = (w >> 3) ^ twist_table[w & 7];
 
                 /*
@@ -494,14 +496,11 @@ static void __add_entropy_words(struct entropy_store *r, const __u32 *in,
         }
 
         r->input_rotate = input_rotate;
-        r->add_ptr = add_ptr;
+        r->add_ptr = i;
 
-        if (out) {
-                for (i = 0; i < 16; i++) {
-                        out[i] = r->pool[add_ptr];
-                        add_ptr = (add_ptr - 1) & wordmask;
-                }
-        }
+        if (out)
+                for (j = 0; j < 16; j++)
+                        out[j] = r->pool[(i - j) & wordmask];
 
         spin_unlock_irqrestore(&r->lock, flags);
 }