Eric Sandeen tracked an XFS on ARM corruption bug down to a function
under fs/xfs/ involving some get_unaligned() calls on u64 pointers.
As it turns out, calling ARM's get_unaligned() on a u64 pointer
pointing to the following byte sequence:
80 81 82 83 84 85 86 87
would return
ffffffff83828180 (LE mode.) This turns out to be
because of implicit u8 -> int promotion in ARM's implementation of
various helpers for get_unaligned(), causing them to accidentally
return signed instead of unsigned values, which in turn caused the
subsequent casts to unsigned long long in __get_unaligned_8_[bl]e()
to sign-extend the lower words.
Fix by casting the return values of __get_unaligned_[24]_[bl]e()
to unsigned int.
Cc: Eric Sandeen <sandeen@sandeen.net>
Cc: Rabeeh Khoury <rabeeh@marvell.com>
Cc: Nicolas Pitre <nico@marvell.com>
Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
*/
#define __get_unaligned_2_le(__p) \
- (__p[0] | __p[1] << 8)
+ (unsigned int)(__p[0] | __p[1] << 8)
#define __get_unaligned_2_be(__p) \
- (__p[0] << 8 | __p[1])
+ (unsigned int)(__p[0] << 8 | __p[1])
#define __get_unaligned_4_le(__p) \
- (__p[0] | __p[1] << 8 | __p[2] << 16 | __p[3] << 24)
+ (unsigned int)(__p[0] | __p[1] << 8 | __p[2] << 16 | __p[3] << 24)
#define __get_unaligned_4_be(__p) \
- (__p[0] << 24 | __p[1] << 16 | __p[2] << 8 | __p[3])
+ (unsigned int)(__p[0] << 24 | __p[1] << 16 | __p[2] << 8 | __p[3])
#define __get_unaligned_8_le(__p) \
((unsigned long long)__get_unaligned_4_le((__p+4)) << 32 | \