Skip to content

Commit 713a851

Browse files
davidarinzonPaolo Abeni
authored andcommitted
net: ena: Fix potential sign extension issue
Small unsigned types are promoted to larger signed types in the case of multiplication, the result of which may overflow. In case the result of such a multiplication has its MSB turned on, it will be sign extended with '1's. This changes the multiplication result. Code example of the phenomenon: ------------------------------- u16 x, y; size_t z1, z2; x = y = 0xffff; printk("x=%x y=%x\n",x,y); z1 = x*y; z2 = (size_t)x*y; printk("z1=%lx z2=%lx\n", z1, z2); Output: ------- x=ffff y=ffff z1=fffffffffffe0001 z2=fffe0001 The expected result of ffff*ffff is fffe0001, and without the explicit casting to avoid the unwanted sign extension we got fffffffffffe0001. This commit adds an explicit casting to avoid the sign extension issue. Fixes: 689b2bd ("net: ena: add functions for handling Low Latency Queues in ena_com") Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com> Signed-off-by: David Arinzon <darinzon@amazon.com> Reviewed-by: Shannon Nelson <shannon.nelson@amd.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
1 parent fe3eb40 commit 713a851

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

drivers/net/ethernet/amazon/ena/ena_com.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -351,7 +351,7 @@ static int ena_com_init_io_sq(struct ena_com_dev *ena_dev,
351351
ENA_COM_BOUNCE_BUFFER_CNTRL_CNT;
352352
io_sq->bounce_buf_ctrl.next_to_use = 0;
353353

354-
size = io_sq->bounce_buf_ctrl.buffer_size *
354+
size = (size_t)io_sq->bounce_buf_ctrl.buffer_size *
355355
io_sq->bounce_buf_ctrl.buffers_num;
356356

357357
dev_node = dev_to_node(ena_dev->dmadev);

0 commit comments

Comments
 (0)