From: Tvrtko Ursulin <[email protected]> It is necessary to ensure types on both sides of the comparison are of the same width. Otherwise the check overflows sooner than expect due left hand side being an unsigned long length, and the right hand side unsigned int number of elements multiplied by element size.
Signed-off-by: Tvrtko Ursulin <[email protected]> Cc: Bart Van Assche <[email protected]> Cc: Hannes Reinecke <[email protected]> Cc: Johannes Thumshirn <[email protected]> Cc: Jens Axboe <[email protected]> --- lib/scatterlist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/scatterlist.c b/lib/scatterlist.c index 581a2e91e515..c87243d46f10 100644 --- a/lib/scatterlist.c +++ b/lib/scatterlist.c @@ -485,7 +485,7 @@ struct scatterlist *sgl_alloc_order(unsigned long length, unsigned int order, nent = round_up(length, PAGE_SIZE << order) >> (PAGE_SHIFT + order); /* Check for integer overflow */ - if (length > (nent << (PAGE_SHIFT + order))) + if (length > ((unsigned long)nent << (PAGE_SHIFT + order))) return NULL; nalloc = nent; if (chainable) { -- 2.17.1
