In mptsas_setup_wide_ports() bitmask is a subject to overflow in case of
phy index is greater than 30 because shifted value is not cast to larger
data type before performing arithmetic.
Cast shifted value to u64 to prevent overflow.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 547f9a218436 ("[SCSI] mptsas: wide port support")
Signed-off-by: Aleksandr Mishin <amishin@xxxxxxxxxx>
---
drivers/message/fusion/mptsas.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index a0bcb0864ecd..6641e305e888 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -915,7 +915,7 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
port_details->port_info = port_info;
if (phy_info->phy_id < 64 )
port_details->phy_bitmask |=
- (1 << phy_info->phy_id);
+ ((u64)1 << phy_info->phy_id);
phy_info->sas_port_add_phy=1;
dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "\t\tForming port\n\t\t"
"phy_id=%d sas_address=0x%018llX\n",
@@ -957,7 +957,7 @@ mptsas_setup_wide_ports(MPT_ADAPTER *ioc, struct mptsas_portinfo *port_info)
phy_info_cmp->port_details = port_details;
if (phy_info_cmp->phy_id < 64 )
port_details->phy_bitmask |=
- (1 << phy_info_cmp->phy_id);
+ ((u64)1 << phy_info_cmp->phy_id);
port_details->num_phys++;
}
}
--
2.30.2
