From: H Hartley Sweeten Date: Mon, 20 Apr 2015 18:49:04 +0000 (-0700) Subject: staging: comedi: comedi_bond: fix 'b_mask' calc in bonding_dio_insn_bits() X-Git-Tag: firefly_0821_release~176^2~1545^2~964 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=b3ab6fbfd8625232c54d70e29f7274118726ba45;p=firefly-linux-kernel-4.4.55.git staging: comedi: comedi_bond: fix 'b_mask' calc in bonding_dio_insn_bits() 'b_chans' may be a valud up to 32. 'b_mask' is an unsigned int and a left shift of more than 31 bits has undefined behavior. Fix the calc so it works correctly with a 'b_chans' of 32.. Reported-by: coverity (CID 1192244) Signed-off-by: H Hartley Sweeten Reviewed-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/staging/comedi/drivers/comedi_bond.c b/drivers/staging/comedi/drivers/comedi_bond.c index 96db0c2686a1..50b76eccb7d7 100644 --- a/drivers/staging/comedi/drivers/comedi_bond.c +++ b/drivers/staging/comedi/drivers/comedi_bond.c @@ -101,7 +101,8 @@ static int bonding_dio_insn_bits(struct comedi_device *dev, b_chans = bdev->nchans - base_chan; if (b_chans > n_left) b_chans = n_left; - b_mask = (1U << b_chans) - 1; + b_mask = (b_chans < 32) ? ((1 << b_chans) - 1) + : 0xffffffff; b_write_mask = (write_mask >> n_done) & b_mask; b_data_bits = (data_bits >> n_done) & b_mask; /* Read/Write the new digital lines. */