Author: cebbert
Update of /cvs/pkgs/rpms/kernel/devel
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv7203
Modified Files:
kernel.spec
Added Files:
linux-2.6-libata-avoid-overflow-with-large-disks.patch
Log Message:
Fix overflow in libata when using large disks.
linux-2.6-libata-avoid-overflow-with-large-disks.patch:
--- NEW FILE linux-2.6-libata-avoid-overflow-with-large-disks.patch ---
From: Roland Dreier <rdreier(a)cisco.com>
Date: Tue, 28 Oct 2008 23:52:20 +0000 (-0700)
Subject: libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
X-Git-Url:
http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fjgarzik%2Flibata-dev.git;...
libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
In ata_tf_to_lba48(), when evaluating
(tf->hob_lbal & 0xff) << 24
the expression is promoted to signed int (since int can hold all values
of u8). However, if hob_lbal is 128 or more, then it is treated as a
negative signed value and sign-extended when promoted to u64 to | into
sectors, which leads to the MSB 32 bits of section getting set
incorrectly.
For example, Phillip O'Donnell <phillip.odonnell(a)gmail.com> reported
that a 1.5GB drive caused:
ata3.00: HPA detected: current 2930277168, native 18446744072344861488
where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30
which shows the problem when hob_lbal is 0xae.
Fix this by adding a cast to u64, just as is used by for hob_lbah and
hob_lbam in the function.
Reported-by: Phillip O'Donnell <phillip.odonnell(a)gmail.com>
Signed-off-by: Roland Dreier <rolandd(a)cisco.com>
Signed-off-by: Jeff Garzik <jgarzik(a)redhat.com>
---
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index e398df1..8824c8d 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1268,7 +1268,7 @@ u64 ata_tf_to_lba48(const struct ata_taskfile *tf)
sectors |= ((u64)(tf->hob_lbah & 0xff)) << 40;
sectors |= ((u64)(tf->hob_lbam & 0xff)) << 32;
- sectors |= (tf->hob_lbal & 0xff) << 24;
+ sectors |= ((u64)(tf->hob_lbal & 0xff)) << 24;
sectors |= (tf->lbah & 0xff) << 16;
sectors |= (tf->lbam & 0xff) << 8;
sectors |= (tf->lbal & 0xff);
Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/kernel.spec,v
retrieving revision 1.1106
retrieving revision 1.1107
diff -u -r1.1106 -r1.1107
--- kernel.spec 31 Oct 2008 08:07:10 -0000 1.1106
+++ kernel.spec 31 Oct 2008 23:08:01 -0000 1.1107
@@ -632,6 +632,7 @@
Patch670: linux-2.6-ata-quirk.patch
Patch671: linux-2.6-libata-pata_it821x-fix-lba48-on-raid-volumes.patch
+Patch672: linux-2.6-libata-avoid-overflow-with-large-disks.patch
#Patch680: linux-2.6-iwlwifi-use-dma_alloc_coherent.patch
Patch681: linux-2.6-iwlagn-downgrade-BUG_ON-in-interrupt.patch
@@ -1224,6 +1225,8 @@
ApplyPatch linux-2.6-ata-quirk.patch
# fix it821x raid volumes
ApplyPatch linux-2.6-libata-pata_it821x-fix-lba48-on-raid-volumes.patch
+# fix overlow with large disk
+ApplyPatch linux-2.6-libata-avoid-overflow-with-large-disks.patch
# fix spot's iwlwifi, hopefully...
#ApplyPatch linux-2.6-iwlwifi-use-dma_alloc_coherent.patch
@@ -1884,6 +1887,9 @@
%kernel_variant_files -k vmlinux %{with_kdump} kdump
%changelog
+* Fri Oct 31 2008 Chuck Ebbert <cebbert(a)redhat.com> 2.6.27.4-71
+- Fix overflow in libata when using large disks.
+
* Fri Oct 31 2008 Chuck Ebbert <cebbert(a)redhat.com> 2.6.27.4-70
- Silence bogus MTRR warning when running in vmware (#468845)
- Remove xen dependencies patch, now upstream and not needed in Fedora.