diff options
| author | Peng Fan <Peng.Fan@freescale.com> | 2015-09-07 13:13:02 +0800 |
|---|---|---|
| committer | Nitin Garg <nitin.garg@nxp.com> | 2016-01-14 11:02:38 -0600 |
| commit | f21ddfdc339d49cdb244bc193d8b929acfeb05d5 (patch) | |
| tree | dfd957c04df526cc62bc08bd7ac7517de7bad4ee /drivers/mtd | |
| parent | a0927aa090ba167c2e8298a8d7ecb025ae1b4fe0 (diff) | |
MLK-11393 mtd: blkdevs: fix multiplication overflow
The type of new->size is unsigned long and the type of tr->blksize is int,
the result of 'new->size * tr->blksize' may exceed ULONG_MAX on 32bit
machines.
Take nand chip MT29F32G08CBADBWP which is 4GB for example. The parameters
passed to kernel is 'mtdparts=gpmi-nand:-(user)', the whole nand chip will be
treated as a 4GB mtd partition. new->size is 0x800000 and tr->blksize is
0x200, 'new->size * tr->blksize' however is 0. This is what we do not want
to see.
Type cast new->size to u64 to fix the multiplication overflow issue.
Signed-off-by: Peng Fan <Peng.Fan@freescale.com>
(cherry picked from commit 5e3aae04da7488ebb02cb22810ccd3e30226cf3f)
Diffstat (limited to 'drivers/mtd')
| -rw-r--r-- | drivers/mtd/mtd_blkdevs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index df7c6c70757a..c0bb374286f0 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -403,7 +403,7 @@ int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new) snprintf(gd->disk_name, sizeof(gd->disk_name), "%s%d", tr->name, new->devnum); - set_capacity(gd, (new->size * tr->blksize) >> 9); + set_capacity(gd, ((u64)new->size * tr->blksize) >> 9); /* Create the request queue */ spin_lock_init(&new->queue_lock); |