rpms/kernel/F-10 linux-2.6-libata-avoid-overflow-with-large-disks.patch, 1.1, 1.2

[Chuck Ebbert]

Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv12609

Modified Files:
	linux-2.6-libata-avoid-overflow-with-large-disks.patch 
Log Message:
update libata lba48 overflow patch

linux-2.6-libata-avoid-overflow-with-large-disks.patch:

Index: linux-2.6-libata-avoid-overflow-with-large-disks.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-10/linux-2.6-libata-avoid-overflow-with-large-disks.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- linux-2.6-libata-avoid-overflow-with-large-disks.patch	31 Oct 2008 23:08:01 -0000	1.1
+++ linux-2.6-libata-avoid-overflow-with-large-disks.patch	11 Nov 2008 23:24:59 -0000	1.2
@@ -1,40 +1,30 @@
-From: Roland Dreier <rdreier at cisco.com>
-Date: Tue, 28 Oct 2008 23:52:20 +0000 (-0700)
-Subject: libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
-X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fjgarzik%2Flibata-dev.git;a=commitdiff_plain;h=ba14a9c291aa867896a90b3571fcc1c3759942ff
+From: Chuck Ebbert <cebbert at cisco.com>
+Subject: libata: Avoid overflow in libata when tf->hba_lbal > 127
 
-libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
-
-In ata_tf_to_lba48(), when evaluating
-
-	(tf->hob_lbal & 0xff) << 24
-
-the expression is promoted to signed int (since int can hold all values
-of u8).  However, if hob_lbal is 128 or more, then it is treated as a
-negative signed value and sign-extended when promoted to u64 to | into
-sectors, which leads to the MSB 32 bits of section getting set
-incorrectly.
+libata: Avoid overflow in libata when tf->hba_lbal > 127
 
-For example, Phillip O'Donnell <phillip.odonnell at gmail.com> reported
-that a 1.5GB drive caused:
+Combination of these two upstream patches:
 
-    ata3.00: HPA detected: current 2930277168, native 18446744072344861488
-
-where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30
-which shows the problem when hob_lbal is 0xae.
+ba14a9c291aa867896a90b3571fcc1c3759942ff
+libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
 
-Fix this by adding a cast to u64, just as is used by for hob_lbah and
-hob_lbam in the function.
+44901a96847b9967c057832b185e2f34ee6a14e5
+libata: Avoid overflow in ata_tf_read_block() when tf->hba_lbal > 127
 
-Reported-by: Phillip O'Donnell <phillip.odonnell at gmail.com>
-Signed-off-by: Roland Dreier <rolandd at cisco.com>
-Signed-off-by: Jeff Garzik <jgarzik at redhat.com>
----
+Signed-off-by: Chuck Ebbert <cebbert at redhat.com>
 
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index e398df1..8824c8d 100644
+diff a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
 --- a/drivers/ata/libata-core.c
 +++ b/drivers/ata/libata-core.c
+@@ -612,7 +612,7 @@ u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev)
+ 		if (tf->flags & ATA_TFLAG_LBA48) {
+ 			block |= (u64)tf->hob_lbah << 40;
+ 			block |= (u64)tf->hob_lbam << 32;
+-			block |= tf->hob_lbal << 24;
++			block |= (u64)tf->hob_lbal << 24;
+ 		} else
+ 			block |= (tf->device & 0xf) << 24;
+ 
 @@ -1268,7 +1268,7 @@ u64 ata_tf_to_lba48(const struct ata_taskfile *tf)
  
  	sectors |= ((u64)(tf->hob_lbah & 0xff)) << 40;