From 52a5690efb034c16e1a81b4124c55aa27e3e0138 Mon Sep 17 00:00:00 2001 From: Bin Meng Date: Sat, 2 Sep 2017 08:15:36 -0700 Subject: [PATCH] nvme: Fix potential sign extension issue in nvme_blk_rw() "lbas" with type "u16" (16 bits, unsigned) is promoted in "lbas << ns->lba_shift" to type "int" (32 bits, signed), then sign-extended to type "unsigned long long" (64 bits, unsigned). If "lbas << ns->lba_shift" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1. Fix it by casting "lbas" to "u32". Reported-by: Coverity (CID: 166730) Signed-off-by: Bin Meng Reviewed-by: Tom Rini --- drivers/nvme/nvme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nvme/nvme.c b/drivers/nvme/nvme.c index 4448754..59d54eb 100644 --- a/drivers/nvme/nvme.c +++ b/drivers/nvme/nvme.c @@ -723,7 +723,7 @@ static ulong nvme_blk_rw(struct udevice *udev, lbaint_t blknr, &c, NULL, IO_TIMEOUT); if (status) break; - temp_len -= lbas << ns->lba_shift; + temp_len -= (u32)lbas << ns->lba_shift; buffer += lbas << ns->lba_shift; }