summaryrefslogtreecommitdiff
path: root/drivers/char
diff options
context:
space:
mode:
authorColin Ian King <colin.king@canonical.com>2018-06-05 17:51:07 +0100
committerCorey Minyard <cminyard@mvista.com>2018-09-18 16:15:33 -0500
commit97a103e6b584442cd848887ed8d47be2410b7e09 (patch)
tree541150ef74955d3c004171e3145febb498c70634 /drivers/char
parent01508d9ebf4fc863f2fc4561c390bf4b7c3301a6 (diff)
ipmi_si: fix potential integer overflow on large shift
Shifting unsigned char b by an int type can lead to sign-extension overflow. For example, if b is 0xff and the shift is 24, then top bit is sign-extended so the final value passed to writeq has all the upper 32 bits set. Fix this by casting b to a 64 bit unsigned before the shift. Detected by CoverityScan, CID#1465246 ("Unintended sign extension") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Corey Minyard <cminyard@mvista.com>
Diffstat (limited to 'drivers/char')
-rw-r--r--drivers/char/ipmi/ipmi_si_mem_io.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/ipmi/ipmi_si_mem_io.c b/drivers/char/ipmi/ipmi_si_mem_io.c
index 1b869d530884..fd0ec8d6bf0e 100644
--- a/drivers/char/ipmi/ipmi_si_mem_io.c
+++ b/drivers/char/ipmi/ipmi_si_mem_io.c
@@ -51,7 +51,7 @@ static unsigned char mem_inq(const struct si_sm_io *io, unsigned int offset)
static void mem_outq(const struct si_sm_io *io, unsigned int offset,
unsigned char b)
{
- writeq(b << io->regshift, (io->addr)+(offset * io->regspacing));
+ writeq((u64)b << io->regshift, (io->addr)+(offset * io->regspacing));
}
#endif