diff options
| author | Bin Meng <bmeng.cn@gmail.com> | 2017-09-02 08:15:36 -0700 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2017-09-03 15:30:33 -0400 |
| commit | 52a5690efb034c16e1a81b4124c55aa27e3e0138 (patch) | |
| tree | f393ee88eba909a156b608b3a21654759e94dbc6 /drivers/nvme | |
| parent | 37d46870b31724b71f593de3eda274e9ad8026d4 (diff) | |
nvme: Fix potential sign extension issue in nvme_blk_rw()
"lbas" with type "u16" (16 bits, unsigned) is promoted in
"lbas << ns->lba_shift" to type "int" (32 bits, signed), then
sign-extended to type "unsigned long long" (64 bits, unsigned).
If "lbas << ns->lba_shift" is greater than 0x7FFFFFFF, the upper
bits of the result will all be 1.
Fix it by casting "lbas" to "u32".
Reported-by: Coverity (CID: 166730)
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
Diffstat (limited to 'drivers/nvme')
| -rw-r--r-- | drivers/nvme/nvme.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/nvme/nvme.c b/drivers/nvme/nvme.c index 4448754aca..59d54eb93e 100644 --- a/drivers/nvme/nvme.c +++ b/drivers/nvme/nvme.c @@ -723,7 +723,7 @@ static ulong nvme_blk_rw(struct udevice *udev, lbaint_t blknr, &c, NULL, IO_TIMEOUT); if (status) break; - temp_len -= lbas << ns->lba_shift; + temp_len -= (u32)lbas << ns->lba_shift; buffer += lbas << ns->lba_shift; } |