Commit ac8672ea authored Aug 16, 2009 by Tejun Heo Committed by Jeff Garzik Sep 08, 2009

libata: fix off-by-one error in ata_tf_read_block()



ata_tf_read_block() has off-by-one error when converting CHS address
to LBA.  The bug isn't very visible because ata_tf_read_block() is
used only when generating sense data for a failed RW command and CHS
addressing isn't used too often these days.

This problem was spotted by Atsushi Nemoto.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

parent 1b549dcb

drivers/ata/libata-core.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -709,7 +709,13 @@ u64 ata_tf_read_block(struct ata_taskfile tf, struct ata_device dev)
		head = tf->device & 0xf;
		sect = tf->lbal;

		block = (cyl * dev->heads + head) * dev->sectors + sect;
		if (!sect) {
		ata_dev_printk(dev, KERN_WARNING, "device reported "
		"invalid CHS sector 0\n");
		sect = 1; /* oh well */
		}

		block = (cyl * dev->heads + head) * dev->sectors + sect - 1;
		}

		return block;