Home » Mailing list archives » linux-kernel » 2008 » October » 28

[PATCH] libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: Roland Dreier
Subject: [PATCH] libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
Date: Tuesday, October 28, 2008 - 4:52 pm

In ata_tf_to_lba48(), when evaluating

	(tf->hob_lbal & 0xff) << 24

the expression is promoted to signed int (since int can hold all values
of u8).  However, if hob_lbal is 128 or more, then it is treated as a
negative signed value and sign-extended when promoted to u64 to | into
sectors, which leads to the MSB 32 bits of section getting set
incorrectly.

For example, Phillip O'Donnell <phillip.odonnell@gmail.com> reported
that a 1.5GB drive caused:

    ata3.00: HPA detected: current 2930277168, native 18446744072344861488

where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30
which shows the problem when hob_lbal is 0xae.

Fix this by adding a cast to u64, just as is used by for hob_lbah and
hob_lbam in the function.

Reported-by: Phillip O'Donnell <phillip.odonnell@gmail.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
---
Phillip, this should fix at least your cosmetic issue; can you test it
and report back?

Thanks,
  Roland

 drivers/ata/libata-core.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index bbb3cae..10424ff 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1268,7 +1268,7 @@ u64 ata_tf_to_lba48(const struct ata_taskfile *tf)
 
 	sectors |= ((u64)(tf->hob_lbah & 0xff)) << 40;
 	sectors |= ((u64)(tf->hob_lbam & 0xff)) << 32;
-	sectors |= (tf->hob_lbal & 0xff) << 24;
+	sectors |= ((u64)(tf->hob_lbal & 0xff)) << 24;
 	sectors |= (tf->lbah & 0xff) << 16;
 	sectors |= (tf->lbam & 0xff) << 8;
 	sectors |= (tf->lbal & 0xff);
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
sata errors with Seagate 1.5TB on AMD 780G/SB700 motherboard, Oskar Liljeblad, (Tue Oct 28, 10:01 am)
Re: sata errors with Seagate 1.5TB on AMD 780G/SB700 mothe ..., David Rees, (Tue Oct 28, 10:59 am)
Re: sata errors with Seagate 1.5TB on AMD 780G/SB700 mothe ..., Phillip O'Donnell, (Tue Oct 28, 4:25 pm)
[PATCH] libata: Avoid overflow in ata_tf_to_lba48() when t ..., Roland Dreier, (Tue Oct 28, 4:52 pm)
Re: [PATCH] libata: Avoid overflow in ata_tf_to_lba48() wh ..., Phillip O'Donnell, (Tue Oct 28, 7:04 pm)
Re: [PATCH] libata: Avoid overflow in ata_tf_to_lba48() wh ..., Phillip O'Donnell, (Wed Oct 29, 6:28 am)
Re: [PATCH] libata: Avoid overflow in ata_tf_to_lba48() wh ..., Jeff Garzik, (Thu Oct 30, 10:45 pm)
[PATCH] libata: Avoid overflow in ata_tf_read_block() when ..., Roland Dreier, (Tue Nov 4, 11:34 am)
Re: [PATCH] libata: Avoid overflow in ata_tf_read_block() ..., Jeff Garzik, (Tue Nov 11, 1:02 am)