From f5cd2ae1e4ad23bc6527b4a667d3f27534730cc5 Mon Sep 17 00:00:00 2001 From: Brian Norris Date: Sat, 28 Feb 2015 02:13:13 -0800 Subject: [PATCH] mtd: nand_bbt: fix theoretical integer overflow in BBT write This statement was written with a cast-to-loff_t to be sure to have a full 64-bit mask. However, we don't account for the fact that '1 << this->bbt_erase_shift' might already overflow. This will not be a problem in practice, since eraseblocks should never be anywhere near 4GiB. But we can do this for completeness, and quiet Coverity in the meantime. CID #1226806. Signed-off-by: Brian Norris --- drivers/mtd/nand/nand_bbt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/nand/nand_bbt.c b/drivers/mtd/nand/nand_bbt.c index 516db2c4524b..2c4fa1a17031 100644 --- a/drivers/mtd/nand/nand_bbt.c +++ b/drivers/mtd/nand/nand_bbt.c @@ -719,7 +719,7 @@ static int write_bbt(struct mtd_info *mtd, uint8_t *buf, /* Must we save the block contents? */ if (td->options & NAND_BBT_SAVECONTENT) { /* Make it block aligned */ - to &= ~((loff_t)((1 << this->bbt_erase_shift) - 1)); + to &= ~(((loff_t)1 << this->bbt_erase_shift) - 1); len = 1 << this->bbt_erase_shift; res = mtd_read(mtd, to, len, &retlen, buf); if (res < 0) { -- 2.34.1