diff options
| author | Chuck Ebbert <cebbert@redhat.com> | 2008-11-21 18:23:34 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2008-12-05 10:55:20 -0800 |
| commit | 0d34e251e22ac0899897842a7495a84fa953ce55 (patch) | |
| tree | 7c71e1d4a4da4bd97a27bb6d32ffe28fa6832eb7 /drivers | |
| parent | 1276c95fe2a0ac95de7ff511296f01964bd73e38 (diff) | |
| download | linux-stable-0d34e251e22ac0899897842a7495a84fa953ce55.tar.gz linux-stable-0d34e251e22ac0899897842a7495a84fa953ce55.tar.bz2 linux-stable-0d34e251e22ac0899897842a7495a84fa953ce55.zip | |
libata: Avoid overflow in libata when tf->hba_lbal > 127
Combination of these two upstream patches:
ba14a9c291aa867896a90b3571fcc1c3759942ff
libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
44901a96847b9967c057832b185e2f34ee6a14e5
libata: Avoid overflow in ata_tf_read_block() when tf->hba_lbal > 127
Originally written by Roland Dreier, but backported by Chuck.
Cc: Roland Dreier <rdreier@cisco.com>
Cc: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/ata/libata-core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 8228ae3f8a16..98ccc22e2f1c 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -551,7 +551,7 @@ u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev) if (tf->flags & ATA_TFLAG_LBA48) { block |= (u64)tf->hob_lbah << 40; block |= (u64)tf->hob_lbam << 32; - block |= tf->hob_lbal << 24; + block |= (u64)tf->hob_lbal << 24; } else block |= (tf->device & 0xf) << 24; @@ -1207,7 +1207,7 @@ u64 ata_tf_to_lba48(const struct ata_taskfile *tf) sectors |= ((u64)(tf->hob_lbah & 0xff)) << 40; sectors |= ((u64)(tf->hob_lbam & 0xff)) << 32; - sectors |= (tf->hob_lbal & 0xff) << 24; + sectors |= ((u64)(tf->hob_lbal & 0xff)) << 24; sectors |= (tf->lbah & 0xff) << 16; sectors |= (tf->lbam & 0xff) << 8; sectors |= (tf->lbal & 0xff); |