Author: cem
Date: Thu Jan 30 18:12:24 2020
New Revision: 357300
URL: https://svnweb.freebsd.org/changeset/base/357300
Log:
aic7xxx(4): Fix unintended sign extension in ahd_inq()
ahd_inb() returns type uint8_t. The shift left by untyped 24 implicitly
promotes the result to type (signed) int. Then the binary OR with uint64_t
values sign-extends the integer. If bit 31 of the read value happened to be
set, the 64-bit result would have all upper 32 bits set to 1 due to OR. This
is clearly not intended.
Reported by: Coverity
CID: 980473 (old one!)
Modified:
head/sys/dev/aic7xxx/aic79xx_inline.h
Modified: head/sys/dev/aic7xxx/aic79xx_inline.h
==============================================================================
--- head/sys/dev/aic7xxx/aic79xx_inline.h Thu Jan 30 17:50:51 2020
(r357299)
+++ head/sys/dev/aic7xxx/aic79xx_inline.h Thu Jan 30 18:12:24 2020
(r357300)
@@ -567,7 +567,7 @@ ahd_inq(struct ahd_softc *ahd, u_int port)
return ((ahd_inb(ahd, port))
| (ahd_inb(ahd, port+1) << 8)
| (ahd_inb(ahd, port+2) << 16)
- | (ahd_inb(ahd, port+3) << 24)
+ | (((uint64_t)ahd_inb(ahd, port+3)) << 24)
| (((uint64_t)ahd_inb(ahd, port+4)) << 32)
| (((uint64_t)ahd_inb(ahd, port+5)) << 40)
| (((uint64_t)ahd_inb(ahd, port+6)) << 48)
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
