aboutsummaryrefslogtreecommitdiff
path: root/drivers/ata
diff options
context:
space:
mode:
authorRoland Dreier <rdreier@cisco.com>2008-11-04 10:34:48 -0800
committerJeff Garzik <jgarzik@redhat.com>2008-11-11 02:59:27 -0500
commit44901a96847b9967c057832b185e2f34ee6a14e5 (patch)
tree25f7948890de3b93bc93e5ce9938c2fc75348ea8 /drivers/ata
parenta12d6c9a09c644cb4a35be099eb5124d38e4feb8 (diff)
libata: Avoid overflow in ata_tf_read_block() when tf->hba_lbal > 127
Phillip O'Donnell <phillip.odonnell@gmail.com> pointed out that the same sign extension bug that was fixed in commit ba14a9c2 ("libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127") also appears to exist in ata_tf_read_block(). Fix this by adding a cast to u64. Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Diffstat (limited to 'drivers/ata')
-rw-r--r--drivers/ata/libata-core.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 0cd3ad49713..4214bfb13bb 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -612,7 +612,7 @@ u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev)
if (tf->flags & ATA_TFLAG_LBA48) {
block |= (u64)tf->hob_lbah << 40;
block |= (u64)tf->hob_lbam << 32;
- block |= tf->hob_lbal << 24;
+ block |= (u64)tf->hob_lbal << 24;
} else
block |= (tf->device & 0xf) << 24;