nvme: Fix potential sign extension issue in nvme_blk_rw()

"lbas" with type "u16" (16 bits, unsigned) is promoted in "lbas << ns->lba_shift" to type "int" (32 bits, signed), then sign-extended to type "unsigned long long" (64 bits, unsigned). If "lbas << ns->lba_shift" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. Fix it by casting "lbas" to "u32". Reported-by: Coverity (CID: 166730) Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Tom Rini <trini@konsulko.com>

nvme: Fix potential sign extension issue in nvme_blk_rw()
"lbas" with type "u16" (16 bits, unsigned) is promoted in "lbas << ns->lba_shift" to type "int" (32 bits, signed), then sign-extended to type "unsigned long long" (64 bits, unsigned). If "lbas << ns->lba_shift" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. Fix it by casting "lbas" to "u32". Reported-by: Coverity (CID: 166730) Signed-off-by: Bin Meng <bmeng.cn@gmail.com> Reviewed-by: Tom Rini <trini@konsulko.com>
Bin Meng · Tom Rini
1 parent 37d46870b3
Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff
drivers/nvme/nvme.c
@@ -723,7 +723,7 @@
 				&c, NULL, IO_TIMEOUT);
 		if (status)
 			break;
-		temp_len -= lbas << ns->lba_shift;
+		temp_len -= (u32)lbas << ns->lba_shift;
 		buffer += lbas << ns->lba_shift;
 	}
...	...	@@ -723,7 +723,7 @@
723	723	&c, NULL, IO_TIMEOUT);
724	724	if (status)
725	725	break;
726		- temp_len -= lbas << ns->lba_shift;
	726	+ temp_len -= (u32)lbas << ns->lba_shift;
727	727	buffer += lbas << ns->lba_shift;
728	728	}
729	729