]>
Commit | Line | Data |
---|---|---|
f601ab3a SL |
1 | From b01ece8c3fc5dfe3061f377fb911e2a10a1fd22b Mon Sep 17 00:00:00 2001 |
2 | From: Colin Ian King <colin.king@canonical.com> | |
3 | Date: Tue, 15 Jan 2019 18:03:38 +0000 | |
4 | Subject: atm: he: fix sign-extension overflow on large shift | |
5 | ||
6 | [ Upstream commit cb12d72b27a6f41325ae23a11033cf5fedfa1b97 ] | |
7 | ||
8 | Shifting the 1 by exp by an int can lead to sign-extension overlow when | |
9 | exp is 31 since 1 is an signed int and sign-extending this result to an | |
10 | unsigned long long will set the upper 32 bits. Fix this by shifting an | |
11 | unsigned long. | |
12 | ||
13 | Detected by cppcheck: | |
14 | (warning) Shifting signed 32-bit value by 31 bits is undefined behaviour | |
15 | ||
16 | Signed-off-by: Colin Ian King <colin.king@canonical.com> | |
17 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
18 | Signed-off-by: Sasha Levin <sashal@kernel.org> | |
19 | --- | |
20 | drivers/atm/he.c | 2 +- | |
21 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
22 | ||
23 | diff --git a/drivers/atm/he.c b/drivers/atm/he.c | |
24 | index 0f5cb37636bcc..010581e8bee05 100644 | |
25 | --- a/drivers/atm/he.c | |
26 | +++ b/drivers/atm/he.c | |
27 | @@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev) | |
28 | instead of '/ 512', use '>> 9' to prevent a call | |
29 | to divdu3 on x86 platforms | |
30 | */ | |
31 | - rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9; | |
32 | + rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9; | |
33 | ||
34 | if (rate_cps < 10) | |
35 | rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */ | |
36 | -- | |
37 | 2.19.1 | |
38 |