diff options
| author |   Brian Norris <computersforpeace@gmail.com> | 2014-07-21 19:07:12 -0700 |
|---|---|---|
| committer | Brian Norris <computersforpeace@gmail.com> | 2014-08-19 11:53:08 -0700 |
| commit | 1001ff7a4f64f3f4264e69d3ed70ff428f627e01 (patch) | |
| tree | 9b673e00fda7873a9958cf5d60f66a49cf2e020c /drivers/mtd/tests/oobtest.c | |
| parent | mtd: mtdswap: fix integer overflow (diff) | |
| download | linux-dev-1001ff7a4f64f3f4264e69d3ed70ff428f627e01.tar.xz linux-dev-1001ff7a4f64f3f4264e69d3ed70ff428f627e01.zip | |
mtd: tests: fix integer overflow issues
These multiplications are done with 32-bit arithmetic, then converted to
64-bit. We should widen the integers first to prevent overflow. This
could be a problem for large (>4GB) MTD's.
Detected by Coverity.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Cc: Akinobu Mita <akinobu.mita@gmail.com>
Diffstat (limited to 'drivers/mtd/tests/oobtest.c')
| -rw-r--r-- | drivers/mtd/tests/oobtest.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/mtd/tests/oobtest.c b/drivers/mtd/tests/oobtest.c index f19ab1acde1f..dc4f9602b97e 100644 --- a/drivers/mtd/tests/oobtest.c +++ b/drivers/mtd/tests/oobtest.c @@ -120,7 +120,7 @@ static int verify_eraseblock(int ebnum) int i; struct mtd_oob_ops ops; int err = 0; - loff_t addr = ebnum * mtd->erasesize; + loff_t addr = (loff_t)ebnum * mtd->erasesize; prandom_bytes_state(&rnd_state, writebuf, use_len_max * pgcnt); for (i = 0; i < pgcnt; ++i, addr += mtd->writesize) { @@ -214,7 +214,7 @@ static int verify_eraseblock_in_one_go(int ebnum) { struct mtd_oob_ops ops; int err = 0; - loff_t addr = ebnum * mtd->erasesize; + loff_t addr = (loff_t)ebnum * mtd->erasesize; size_t len = mtd->ecclayout->oobavail * pgcnt; prandom_bytes_state(&rnd_state, writebuf, len); @@ -568,7 +568,7 @@ static int __init mtd_oobtest_init(void) size_t sz = mtd->ecclayout->oobavail; if (bbt[i] || bbt[i + 1]) continue; - addr = (i + 1) * mtd->erasesize - mtd->writesize; + addr = (loff_t)(i + 1) * mtd->erasesize - mtd->writesize; prandom_bytes_state(&rnd_state, writebuf, sz * cnt); for (pg = 0; pg < cnt; ++pg) { ops.mode = MTD_OPS_AUTO_OOB; @@ -598,7 +598,7 @@ static int __init mtd_oobtest_init(void) continue; prandom_bytes_state(&rnd_state, writebuf, mtd->ecclayout->oobavail * 2); - addr = (i + 1) * mtd->erasesize - mtd->writesize; + addr = (loff_t)(i + 1) * mtd->erasesize - mtd->writesize; ops.mode = MTD_OPS_AUTO_OOB; ops.len = 0; ops.retlen = 0; |