• Roland Dreier's avatar
    libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127 · ba14a9c2
    Roland Dreier authored
    In ata_tf_to_lba48(), when evaluating
    
    	(tf->hob_lbal & 0xff) << 24
    
    the expression is promoted to signed int (since int can hold all values
    of u8).  However, if hob_lbal is 128 or more, then it is treated as a
    negative signed value and sign-extended when promoted to u64 to | into
    sectors, which leads to the MSB 32 bits of section getting set
    incorrectly.
    
    For example, Phillip O'Donnell <phillip.odonnell@gmail.com> reported
    that a 1.5GB drive caused:
    
        ata3.00: HPA detected: current 2930277168, native 18446744072344861488
    
    where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30
    which shows the problem when hob_lbal is 0xae.
    
    Fix this by adding a cast to u64, just as is used by for hob_lbah and
    hob_lbam in the function.
    Reported-by: default avatarPhillip O'Donnell <phillip.odonnell@gmail.com>
    Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
    Signed-off-by: default avatarJeff Garzik <jgarzik@redhat.com>
    ba14a9c2
libata-core.c 164 KB