Skip to main content

Browse the archive

https://github.com/torvalds/linux
17 May 2024, 09:02:56 UTC
Revision ba14a9c291aa867896a90b3571fcc1c3759942ff authored by Roland Dreier on 28 October 2008, 23:52:20 UTC, committed by Jeff Garzik on 31 October 2008, 05:42:59 UTC 
libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
 
In ata_tf_to_lba48(), when evaluating

	(tf->hob_lbal & 0xff) << 24

the expression is promoted to signed int (since int can hold all values
of u8).  However, if hob_lbal is 128 or more, then it is treated as a
negative signed value and sign-extended when promoted to u64 to | into
sectors, which leads to the MSB 32 bits of section getting set
incorrectly.

For example, Phillip O'Donnell <phillip.odonnell@gmail.com> reported
that a 1.5GB drive caused:

    ata3.00: HPA detected: current 2930277168, native 18446744072344861488

where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30
which shows the problem when hob_lbal is 0xae.

Fix this by adding a cast to u64, just as is used by for hob_lbah and
hob_lbam in the function.

Reported-by: Phillip O'Donnell <phillip.odonnell@gmail.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
1 parent 5b97fbd
History
Tip revision: ba14a9c291aa867896a90b3571fcc1c3759942ff authored by Roland Dreier on 28 October 2008, 23:52:20 UTC
libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
Tip revision: ba14a9c
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
usr
virt
.gitignore -rw-r--r-- 867 bytes
.mailmap -rw-r--r-- 3.8 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 91.0 KB
Kbuild -rw-r--r-- 2.4 KB
MAINTAINERS -rw-r--r-- 102.3 KB
Makefile -rw-r--r-- 55.9 KB
README -rw-r--r-- 16.5 KB
REPORTING-BUGS -rw-r--r-- 3.1 KB

README

back to top