linux-kernel - [PATCH net] net: dlink: mask rx_coalesce/rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251223001006.17285-1-yyyynoom@gmail.com>
Date: Tue, 23 Dec 2025 09:10:06 +0900
From: Yeounsu Moon <yyyynoom@...il.com>
To: Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>
Cc: netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Yeounsu Moon <yyyynoom@...il.com>
Subject: [PATCH net] net: dlink: mask rx_coalesce/rx_timeout before writing RxDMAIntCtrl

RxDMAIntCtrl encodes rx_coalesce in the low 16 bits
and rx_timeout in the high 16 bits. If either value exceeds
the field width, the current code may truncate the value and/or
corrupt adjacent bits when programming the register.

Mask both values to 16 bits and cast to u32 before shifting
so only the intended fields are written.

Found by inspection.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Tested-on: D-Link DGE-550T Rev-A3
Signed-off-by: Yeounsu Moon <yyyynoom@...il.com>
---
 drivers/net/ethernet/dlink/dl2k.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
index 846d58c769ea..f6ec0e4689f7 100644
--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
@@ -590,7 +590,8 @@ static void rio_hw_init(struct net_device *dev)
 
 	set_multicast (dev);
 	if (np->coalesce) {
-		dw32(RxDMAIntCtrl, np->rx_coalesce | np->rx_timeout << 16);
+		dw32(RxDMAIntCtrl, ((u32)np->rx_coalesce & 0x0000ffff) |
+				   (((u32)np->rx_timeout & 0x0000ffff) << 16));
 	}
 	/* Set RIO to poll every N*320nsec. */
 	dw8(RxDMAPollPeriod, 0x20);
-- 
2.52.0