diff options
| author | Roland Dreier <rdreier@cisco.com> | 2008-10-29 02:52:20 +0300 |
|---|---|---|
| committer | Jeff Garzik <jgarzik@redhat.com> | 2008-10-31 08:42:59 +0300 |
| commit | ba14a9c291aa867896a90b3571fcc1c3759942ff (patch) | |
| tree | de8e4e3023755848154b6de9e4779e166d70bfc8 /drivers/ata | |
| parent | 5b97fbd093ac2e0da0c7eec894fee065a04af55d (diff) | |
| download | linux-ba14a9c291aa867896a90b3571fcc1c3759942ff.tar.xz | |
libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
In ata_tf_to_lba48(), when evaluating
(tf->hob_lbal & 0xff) << 24
the expression is promoted to signed int (since int can hold all values
of u8). However, if hob_lbal is 128 or more, then it is treated as a
negative signed value and sign-extended when promoted to u64 to | into
sectors, which leads to the MSB 32 bits of section getting set
incorrectly.
For example, Phillip O'Donnell <phillip.odonnell@gmail.com> reported
that a 1.5GB drive caused:
ata3.00: HPA detected: current 2930277168, native 18446744072344861488
where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30
which shows the problem when hob_lbal is 0xae.
Fix this by adding a cast to u64, just as is used by for hob_lbah and
hob_lbam in the function.
Reported-by: Phillip O'Donnell <phillip.odonnell@gmail.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Diffstat (limited to 'drivers/ata')
| -rw-r--r-- | drivers/ata/libata-core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index e398df12fd18..8824c8da3f2f 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -1268,7 +1268,7 @@ u64 ata_tf_to_lba48(const struct ata_taskfile *tf) sectors |= ((u64)(tf->hob_lbah & 0xff)) << 40; sectors |= ((u64)(tf->hob_lbam & 0xff)) << 32; - sectors |= (tf->hob_lbal & 0xff) << 24; + sectors |= ((u64)(tf->hob_lbal & 0xff)) << 24; sectors |= (tf->lbah & 0xff) << 16; sectors |= (tf->lbam & 0xff) << 8; sectors |= (tf->lbal & 0xff); |