Skip to content

Commit 9f499b8

Browse files
committed
minmax: scsi: fix mis-use of 'clamp()' in sr.c
While working on simplifying the minmax functions, and avoiding excessive macro expansion, it turns out that the sr.c use of the 'clamp()' macro has the arguments the wrong way around. The clamp logic is val = clamp(in, low, high); and it returns the input clamped to the low/high limits. But sr.c ddid speed = clamp(0, speed, 0xffff / 177); which clamps the value '0' to the range '[speed, 0xffff / 177]' and ends up being nonsensical. Happily, I don't think anybody ever cared. Fixes: 9fad9d5 ("scsi: sr: Fix unintentional arithmetic wraparound") Cc: Justin Stitt <justinstitt@google.com> Cc: Kees Cook <keescook@chromium.org> Cc: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 1a251f5 commit 9f499b8

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

drivers/scsi/sr_ioctl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -431,7 +431,7 @@ int sr_select_speed(struct cdrom_device_info *cdi, unsigned long speed)
431431
struct packet_command cgc;
432432

433433
/* avoid exceeding the max speed or overflowing integer bounds */
434-
speed = clamp(0, speed, 0xffff / 177);
434+
speed = clamp(speed, 0, 0xffff / 177);
435435

436436
if (speed == 0)
437437
speed = 0xffff; /* set to max */

0 commit comments

Comments
 (0)