Commit ba14a9c2 authored by Roland Dreier's avatar Roland Dreier Committed by Jeff Garzik

libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127

In ata_tf_to_lba48(), when evaluating

	(tf->hob_lbal & 0xff) << 24

the expression is promoted to signed int (since int can hold all values
of u8).  However, if hob_lbal is 128 or more, then it is treated as a
negative signed value and sign-extended when promoted to u64 to | into
sectors, which leads to the MSB 32 bits of section getting set
incorrectly.

For example, Phillip O'Donnell <phillip.odonnell@gmail.com> reported
that a 1.5GB drive caused:

    ata3.00: HPA detected: current 2930277168, native 18446744072344861488

where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30
which shows the problem when hob_lbal is 0xae.

Fix this by adding a cast to u64, just as is used by for hob_lbah and
hob_lbam in the function.
Reported-by: default avatarPhillip O'Donnell <phillip.odonnell@gmail.com>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
Signed-off-by: default avatarJeff Garzik <jgarzik@redhat.com>
parent 5b97fbd0
...@@ -1268,7 +1268,7 @@ u64 ata_tf_to_lba48(const struct ata_taskfile *tf) ...@@ -1268,7 +1268,7 @@ u64 ata_tf_to_lba48(const struct ata_taskfile *tf)
sectors |= ((u64)(tf->hob_lbah & 0xff)) << 40; sectors |= ((u64)(tf->hob_lbah & 0xff)) << 40;
sectors |= ((u64)(tf->hob_lbam & 0xff)) << 32; sectors |= ((u64)(tf->hob_lbam & 0xff)) << 32;
sectors |= (tf->hob_lbal & 0xff) << 24; sectors |= ((u64)(tf->hob_lbal & 0xff)) << 24;
sectors |= (tf->lbah & 0xff) << 16; sectors |= (tf->lbah & 0xff) << 16;
sectors |= (tf->lbam & 0xff) << 8; sectors |= (tf->lbam & 0xff) << 8;
sectors |= (tf->lbal & 0xff); sectors |= (tf->lbal & 0xff);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment