diff options
| author | Colin Ian King <colin.king@canonical.com> | 2018-06-05 17:51:07 +0100 |
|---|---|---|
| committer | Corey Minyard <cminyard@mvista.com> | 2018-09-18 16:15:33 -0500 |
| commit | 97a103e6b584442cd848887ed8d47be2410b7e09 (patch) | |
| tree | 541150ef74955d3c004171e3145febb498c70634 /drivers/char/ipmi | |
| parent | 01508d9ebf4fc863f2fc4561c390bf4b7c3301a6 (diff) | |
ipmi_si: fix potential integer overflow on large shift
Shifting unsigned char b by an int type can lead to sign-extension
overflow. For example, if b is 0xff and the shift is 24, then top
bit is sign-extended so the final value passed to writeq has all
the upper 32 bits set. Fix this by casting b to a 64 bit unsigned
before the shift.
Detected by CoverityScan, CID#1465246 ("Unintended sign extension")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Diffstat (limited to 'drivers/char/ipmi')
| -rw-r--r-- | drivers/char/ipmi/ipmi_si_mem_io.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/ipmi/ipmi_si_mem_io.c b/drivers/char/ipmi/ipmi_si_mem_io.c index 1b869d530884..fd0ec8d6bf0e 100644 --- a/drivers/char/ipmi/ipmi_si_mem_io.c +++ b/drivers/char/ipmi/ipmi_si_mem_io.c @@ -51,7 +51,7 @@ static unsigned char mem_inq(const struct si_sm_io *io, unsigned int offset) static void mem_outq(const struct si_sm_io *io, unsigned int offset, unsigned char b) { - writeq(b << io->regshift, (io->addr)+(offset * io->regspacing)); + writeq((u64)b << io->regshift, (io->addr)+(offset * io->regspacing)); } #endif |