diff options
| author | Kevin Bowling <kbowling@FreeBSD.org> | 2026-07-28 11:10:09 +0000 |
|---|---|---|
| committer | Kevin Bowling <kbowling@FreeBSD.org> | 2026-07-31 11:29:53 +0000 |
| commit | 35374c3ec69aa87561431e6236706c485bdeeacc (patch) | |
| tree | 9183ab39d5c9b8758820de7cc72fb3161d867859 | |
| parent | 8fa2a7503468abb5f863729c4e244d738239503d (diff) | |
ixgbe: avoid signed overflow in pause time calculation
pause_time is promoted to signed int before multiplication. Its default
value of 65535 multiplied by 65537 exceeds INT_MAX and triggers UBSAN,
even though the result is assigned to a u32.
Make the multiplier unsigned so the calculation has the intended u32
semantics. Linux commit 3b70683fc4d6 reported the failure in the generic
path and used the same mechanical correction. The 82598-specific flow
control operation contains the identical expression, so correct it as well.
MFC after: 1 week
| -rw-r--r-- | sys/dev/ixgbe/ixgbe_82598.c | 2 | ||||
| -rw-r--r-- | sys/dev/ixgbe/ixgbe_common.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/sys/dev/ixgbe/ixgbe_82598.c b/sys/dev/ixgbe/ixgbe_82598.c index e32fdb8f039c..f27f263dd07f 100644 --- a/sys/dev/ixgbe/ixgbe_82598.c +++ b/sys/dev/ixgbe/ixgbe_82598.c @@ -535,7 +535,7 @@ s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw) } /* Configure pause time (2 TCs per register) */ - reg = hw->fc.pause_time * 0x00010001; + reg = hw->fc.pause_time * 0x00010001U; for (i = 0; i < (IXGBE_DCB_MAX_TRAFFIC_CLASS / 2); i++) IXGBE_WRITE_REG(hw, IXGBE_FCTTV(i), reg); diff --git a/sys/dev/ixgbe/ixgbe_common.c b/sys/dev/ixgbe/ixgbe_common.c index a8676c731711..0b6bf728f25e 100644 --- a/sys/dev/ixgbe/ixgbe_common.c +++ b/sys/dev/ixgbe/ixgbe_common.c @@ -2932,7 +2932,7 @@ s32 ixgbe_fc_enable_generic(struct ixgbe_hw *hw) } /* Configure pause time (2 TCs per register) */ - reg = hw->fc.pause_time * 0x00010001; + reg = hw->fc.pause_time * 0x00010001U; for (i = 0; i < (IXGBE_DCB_MAX_TRAFFIC_CLASS / 2); i++) IXGBE_WRITE_REG(hw, IXGBE_FCTTV(i), reg); |