Roland Dreier ba14a9c291 libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
In ata_tf_to_lba48(), when evaluating

	(tf->hob_lbal & 0xff) << 24

the expression is promoted to signed int (since int can hold all values
of u8).  However, if hob_lbal is 128 or more, then it is treated as a
negative signed value and sign-extended when promoted to u64 to | into
sectors, which leads to the MSB 32 bits of section getting set
incorrectly.

For example, Phillip O'Donnell <phillip.odonnell@gmail.com> reported
that a 1.5GB drive caused:

    ata3.00: HPA detected: current 2930277168, native 18446744072344861488

where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30
which shows the problem when hob_lbal is 0xae.

Fix this by adding a cast to u64, just as is used by for hob_lbah and
hob_lbam in the function.

Reported-by: Phillip O'Donnell <phillip.odonnell@gmail.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
2008-10-31 01:42:59 -04:00
..
2008-10-21 07:48:21 -04:00
2008-10-26 10:27:01 +01:00
2008-10-22 01:19:39 +02:00
2008-10-30 15:55:47 +01:00
2008-10-26 09:35:05 -07:00
2008-10-21 07:48:33 -04:00
2008-10-30 11:38:46 -07:00
2008-10-21 07:48:37 -04:00
2008-10-28 15:50:54 -07:00
2008-10-16 11:21:30 -07:00
2008-10-21 15:49:55 +11:00
2008-10-23 00:11:07 -04:00
2008-10-23 09:35:18 -07:00
2008-10-20 08:52:36 -07:00
2008-10-30 12:09:07 -07:00
2008-10-30 11:38:47 -07:00
2008-10-28 21:47:17 +00:00