diff options
| author | Roland Dreier <[email protected]> | 2008-11-04 18:34:48 +0000 |
|---|---|---|
| committer | Jeff Garzik <[email protected]> | 2008-11-11 07:59:27 +0000 |
| commit | 44901a96847b9967c057832b185e2f34ee6a14e5 (patch) | |
| tree | 25f7948890de3b93bc93e5ce9938c2fc75348ea8 | |
| parent | [libata] pata_pcmcia: another memory card support (diff) | |
| download | kernel-44901a96847b9967c057832b185e2f34ee6a14e5.tar.gz kernel-44901a96847b9967c057832b185e2f34ee6a14e5.zip | |
libata: Avoid overflow in ata_tf_read_block() when tf->hba_lbal > 127
Phillip O'Donnell <[email protected]> pointed out that the same
sign extension bug that was fixed in commit ba14a9c2 ("libata: Avoid
overflow in ata_tf_to_lba48() when tf->hba_lbal > 127") also appears to
exist in ata_tf_read_block(). Fix this by adding a cast to u64.
Signed-off-by: Roland Dreier <[email protected]>
Signed-off-by: Jeff Garzik <[email protected]>
| -rw-r--r-- | drivers/ata/libata-core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 0cd3ad497136..4214bfb13bbd 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -612,7 +612,7 @@ u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev) if (tf->flags & ATA_TFLAG_LBA48) { block |= (u64)tf->hob_lbah << 40; block |= (u64)tf->hob_lbam << 32; - block |= tf->hob_lbal << 24; + block |= (u64)tf->hob_lbal << 24; } else block |= (tf->device & 0xf) << 24; |