linux-kernel - [PATCH] scsi: fix calculation of phy_addr in mvumi_delete_internal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 16 Dec 2023 21:50:06 +0300
From: Rand Deeb <rand.sec96@...il.com>
To: "James E . J . Bottomley" <jejb@...ux.ibm.com>,
	linux-scsi@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: deeb.rand@...fident.ru,
	lvc-project@...uxtesting.org,
	voskresenski.stanislav@...fident.ru,
	Rand Deeb <rand.sec96@...il.com>
Subject: [PATCH] scsi: fix calculation of phy_addr in mvumi_delete_internal_cmd

The calculation of phy_addr in mvumi_delete_internal_cmd contained an issue
where the expression '(dma_addr_t) ((m_sg->baseaddr_h << 16) << 16)' was used.
This expression was found to be incorrect and useless because it always evaluates
to zero, regardless of the actual value of m_sg->baseaddr_h since it's u32.

This commit resolves the issue by placing the casting inside the brackets, making it
more meaningful: (((dma_addr_t) m_sg->baseaddr_h << 16) << 16)

The corrected expression ensures that phy_addr is calculated correctly and
addresses the previous issue, preventing the unnecessary use of a zero value.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Rand Deeb <rand.sec96@...il.com>
---
 drivers/scsi/mvumi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
index 0354898d7cac..675ea5dcaa21 100644
--- a/drivers/scsi/mvumi.c
+++ b/drivers/scsi/mvumi.c
@@ -296,7 +296,7 @@ static void mvumi_delete_internal_cmd(struct mvumi_hba *mhba,
 			sgd_getsz(mhba, m_sg, size);

 			phy_addr = (dma_addr_t) m_sg->baseaddr_l |
-				(dma_addr_t) ((m_sg->baseaddr_h << 16) << 16);
+				(((dma_addr_t) m_sg->baseaddr_h << 16) << 16);

 			dma_free_coherent(&mhba->pdev->dev, size, cmd->data_buf,
 								phy_addr);
-- 
2.34.1