[PATCH 1/3] staging: comedi: comedi_bond: fix 'b_mask' calc in bonding_dio_insn_bits()

H Hartley Sweeten hsweeten at visionengravers.com
Mon Apr 27 16:49:24 UTC 2015


'b_chans' may be a valud up to 32. 'b_mask' is an unsigned int and a left shift of
more than 31 bits has undefined behavior. Fix the calc so it works correctly with
a 'b_chans' of 32..

Reported-by: coverity (CID 1192244)
Signed-off-by: H Hartley Sweeten <hsweeten at visionengravers.com>
Reviewed-by: Ian Abbott <abbotti at mev.co.uk>
Cc: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 drivers/staging/comedi/drivers/comedi_bond.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/comedi/drivers/comedi_bond.c b/drivers/staging/comedi/drivers/comedi_bond.c
index 96db0c2..566b927 100644
--- a/drivers/staging/comedi/drivers/comedi_bond.c
+++ b/drivers/staging/comedi/drivers/comedi_bond.c
@@ -101,7 +101,8 @@ static int bonding_dio_insn_bits(struct comedi_device *dev,
 			b_chans = bdev->nchans - base_chan;
 			if (b_chans > n_left)
 				b_chans = n_left;
-			b_mask = (1U << b_chans) - 1;
+			b_mask = (b_chans < 32) ? ((1U << b_chans) - 1)
+						: 0xffffffff;
 			b_write_mask = (write_mask >> n_done) & b_mask;
 			b_data_bits = (data_bits >> n_done) & b_mask;
 			/* Read/Write the new digital lines. */
-- 
2.3.0



More information about the devel mailing list