diff options
| author | Colin Ian King <colin.king@canonical.com> | 2018-06-05 19:51:07 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-11-20 20:46:56 +0300 |
| commit | 438bf726def0f5bdc418b1c4ac038355a55f306a (patch) | |
| tree | c912e1f60ea7448e7b570fcec2680bc7283509cb /drivers/char | |
| parent | 78538bae1dab67036efaf9b675b60f1c2f5635b2 (diff) | |
| download | linux-438bf726def0f5bdc418b1c4ac038355a55f306a.tar.xz | |
ipmi_si: fix potential integer overflow on large shift
[ Upstream commit 97a103e6b584442cd848887ed8d47be2410b7e09 ]
Shifting unsigned char b by an int type can lead to sign-extension
overflow. For example, if b is 0xff and the shift is 24, then top
bit is sign-extended so the final value passed to writeq has all
the upper 32 bits set. Fix this by casting b to a 64 bit unsigned
before the shift.
Detected by CoverityScan, CID#1465246 ("Unintended sign extension")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/ipmi/ipmi_si_mem_io.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/ipmi/ipmi_si_mem_io.c b/drivers/char/ipmi/ipmi_si_mem_io.c index 638f4ab88f44..75583612ab10 100644 --- a/drivers/char/ipmi/ipmi_si_mem_io.c +++ b/drivers/char/ipmi/ipmi_si_mem_io.c @@ -51,7 +51,7 @@ static unsigned char mem_inq(const struct si_sm_io *io, unsigned int offset) static void mem_outq(const struct si_sm_io *io, unsigned int offset, unsigned char b) { - writeq(b << io->regshift, (io->addr)+(offset * io->regspacing)); + writeq((u64)b << io->regshift, (io->addr)+(offset * io->regspacing)); } #endif |