Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 44901a96 authored by Roland Dreier's avatar Roland Dreier Committed by Jeff Garzik
Browse files

libata: Avoid overflow in ata_tf_read_block() when tf->hba_lbal > 127 



Phillip O'Donnell <phillip.odonnell@gmail.com> pointed out that the same
sign extension bug that was fixed in commit ba14a9c2 ("libata: Avoid
overflow in ata_tf_to_lba48() when tf->hba_lbal > 127") also appears to
exist in ata_tf_read_block().  Fix this by adding a cast to u64.

Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
Signed-off-by: default avatarJeff Garzik <jgarzik@redhat.com>
parent a12d6c9a

drivers/ata/libata-core.c

+1 −1
Original line number Diff line number Diff line
@@ -612,7 +612,7 @@ u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev) 
		if (tf->flags & ATA_TFLAG_LBA48) {

			block |= (u64)tf->hob_lbah << 40;

			block |= (u64)tf->hob_lbam << 32;

			block |= tf->hob_lbal << 24;

			block |= (u64)tf->hob_lbal << 24;

		} else

			block |= (tf->device & 0xf) << 24;