Bug 469716 - [RHEL5] libata is broken with large disks (1.5TB)
[RHEL5] libata is broken with large disks (1.5TB)
Status: CLOSED DUPLICATE of bug 469715
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel (Show other bugs)
5.3
All Linux
medium Severity medium
: rc
: ---
Assigned To: Chuck Ebbert
Mike Gahagan
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-11-03 12:26 EST by Linda Wang
Modified: 2008-11-03 12:48 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-11-03 12:48:51 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Linda Wang 2008-11-03 12:26:24 EST
Description of problem:

Per this commit headed for upstream:

From: Roland Dreier <rdreier@cisco.com>
Date: Tue, 28 Oct 2008 23:52:20 +0000 (-0700)
Subject: libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fjgarzik%2Flibata-dev.git;a=commitdiff_plain;h=ba14a9c291aa867896a90b3571fcc1c3759942ff

libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127

In ata_tf_to_lba48(), when evaluating

	(tf->hob_lbal & 0xff) << 24

the expression is promoted to signed int (since int can hold all values
of u8).  However, if hob_lbal is 128 or more, then it is treated as a
negative signed value and sign-extended when promoted to u64 to | into
sectors, which leads to the MSB 32 bits of section getting set
incorrectly.

For example, Phillip O'Donnell <phillip.odonnell@gmail.com> reported
that a 1.5GB drive caused:

    ata3.00: HPA detected: current 2930277168, native 18446744072344861488

where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30
which shows the problem when hob_lbal is 0xae.

Fix this by adding a cast to u64, just as is used by for hob_lbah and
hob_lbam in the function.
Version-Release number of selected component (if applicable):


Additional info:
Reported-by: Phillip O'Donnell <phillip.odonnell@gmail.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
---

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index e398df1..8824c8d 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1268,7 +1268,7 @@ u64 ata_tf_to_lba48(const struct ata_taskfile *tf)
 
 	sectors |= ((u64)(tf->hob_lbah & 0xff)) << 40;
 	sectors |= ((u64)(tf->hob_lbam & 0xff)) << 32;
-	sectors |= (tf->hob_lbal & 0xff) << 24;
+	sectors |= ((u64)(tf->hob_lbal & 0xff)) << 24;
 	sectors |= (tf->lbah & 0xff) << 16;
 	sectors |= (tf->lbam & 0xff) << 8;
 	sectors |= (tf->lbal & 0xff);
Comment 1 Linda Wang 2008-11-03 12:48:51 EST

*** This bug has been marked as a duplicate of bug 469715 ***

Note You need to log in before you can comment on or make changes to this bug.