Messages in this thread | | | Date | Wed, 29 Oct 2008 18:39:26 -0600 | From | Robert Hancock <> | Subject | Re: [PATCH] libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127 |
| |
Roland Dreier wrote: > In ata_tf_to_lba48(), when evaluating > > (tf->hob_lbal & 0xff) << 24 > > the expression is promoted to signed int (since int can hold all values > of u8). However, if hob_lbal is 128 or more, then it is treated as a > negative signed value and sign-extended when promoted to u64 to | into > sectors, which leads to the MSB 32 bits of section getting set > incorrectly. > > For example, Phillip O'Donnell <phillip.odonnell@gmail.com> reported > that a 1.5GB drive caused: > > ata3.00: HPA detected: current 2930277168, native 18446744072344861488 > > where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30 > which shows the problem when hob_lbal is 0xae. > > Fix this by adding a cast to u64, just as is used by for hob_lbah and > hob_lbam in the function. > > Reported-by: Phillip O'Donnell <phillip.odonnell@gmail.com> > Signed-off-by: Roland Dreier <rolandd@cisco.com>
This should be pushed to -stable as well once it's merged..
| |