rpms/kernel/F-9 linux-2.6-libata-avoid-overflow-with-large-disks.patch, NONE, 1.1 kernel.spec, 1.833, 1.834

[Chuck Ebbert]

Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-9
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv22751

Modified Files:
	kernel.spec 
Added Files:
	linux-2.6-libata-avoid-overflow-with-large-disks.patch 
Log Message:
Fix overflow in libata when using large disks (>=1.5TB)

linux-2.6-libata-avoid-overflow-with-large-disks.patch:

--- NEW FILE linux-2.6-libata-avoid-overflow-with-large-disks.patch ---
From: Roland Dreier <rdreier at cisco.com>
Date: Tue, 28 Oct 2008 23:52:20 +0000 (-0700)
Subject: libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fjgarzik%2Flibata-dev.git;a=commitdiff_plain;h=ba14a9c291aa867896a90b3571fcc1c3759942ff

libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127

In ata_tf_to_lba48(), when evaluating

	(tf->hob_lbal & 0xff) << 24

the expression is promoted to signed int (since int can hold all values
of u8).  However, if hob_lbal is 128 or more, then it is treated as a
negative signed value and sign-extended when promoted to u64 to | into
sectors, which leads to the MSB 32 bits of section getting set
incorrectly.

For example, Phillip O'Donnell <phillip.odonnell at gmail.com> reported
that a 1.5GB drive caused:

    ata3.00: HPA detected: current 2930277168, native 18446744072344861488

where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30
which shows the problem when hob_lbal is 0xae.

Fix this by adding a cast to u64, just as is used by for hob_lbah and
hob_lbam in the function.

Reported-by: Phillip O'Donnell <phillip.odonnell at gmail.com>
Signed-off-by: Roland Dreier <rolandd at cisco.com>
Signed-off-by: Jeff Garzik <jgarzik at redhat.com>
---

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index e398df1..8824c8d 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1268,7 +1268,7 @@ u64 ata_tf_to_lba48(const struct ata_taskfile *tf)
 
 	sectors |= ((u64)(tf->hob_lbah & 0xff)) << 40;
 	sectors |= ((u64)(tf->hob_lbam & 0xff)) << 32;
-	sectors |= (tf->hob_lbal & 0xff) << 24;
+	sectors |= ((u64)(tf->hob_lbal & 0xff)) << 24;
 	sectors |= (tf->lbah & 0xff) << 16;
 	sectors |= (tf->lbam & 0xff) << 8;
 	sectors |= (tf->lbal & 0xff);


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-9/kernel.spec,v
retrieving revision 1.833
retrieving revision 1.834
diff -u -r1.833 -r1.834
--- kernel.spec	31 Oct 2008 17:07:17 -0000	1.833
+++ kernel.spec	1 Nov 2008 04:20:12 -0000	1.834
@@ -659,6 +659,7 @@
 Patch672: linux-2.6-sata-eeepc-faster.patch
 Patch676: linux-2.6-libata-pata_it821x-fix-lba48-on-raid-volumes.patch
 Patch678: linux-2.6-libata-sata_nv-disable-swncq.patch
+Patch679: linux-2.6-libata-avoid-overflow-with-large-disks.patch
 
 # wireless
 Patch681: linux-2.6-iwlagn-downgrade-BUG_ON-in-interrupt.patch
@@ -1227,6 +1228,8 @@
 ApplyPatch linux-2.6-sata-eeepc-faster.patch
 # disable swncq on sata_nv
 ApplyPatch linux-2.6-libata-sata_nv-disable-swncq.patch
+# Fix libata on 1.5GB disks
+ApplyPatch linux-2.6-libata-avoid-overflow-with-large-disks.patch
 
 # cciss sysfs links are broken
 ApplyPatch linux-2.6-blk-cciss-fix-regression-sysfs-symlink-missing.patch
@@ -1901,6 +1904,9 @@
 %kernel_variant_files -a /%{image_install_path}/xen*-%{KVERREL}.xen -e /etc/ld.so.conf.d/kernelcap-%{KVERREL}.xen.conf %{with_xen} xen
 
 %changelog
+* Sat Oct 01 2008 Chuck Ebbert <cebbert at redhat.com> 2.6.27.4-21
+- Fix overflow in libata when using large disks (>=1.5TB)
+
 * Fri Oct 31 2008 Chuck Ebbert <cebbert at redhat.com> 2.6.27.4-20
 - Remove DRM headers from kernel-headers: they conflict with F9 drm-devel.