[PATCH iwl-next] ice: prevent integer overflow

[PATCH iwl-next] ice: prevent integer overflow

[Aleksandr Loktionov]

From: Lukasz Czapnik <lukasz.czapnik@intel.com>

In ice_sched_bw_to_rl_profile(), the loop over 64 bits computes the
scheduler timestamp rate as:

  ts_rate = div64_long((s64)hw->psm_clk_freq,
                       pow_result * ICE_RL_PROF_TS_MULTIPLIER);

where pow_result = BIT_ULL(i). For large values of i, the product
pow_result * ICE_RL_PROF_TS_MULTIPLIER overflows u64 before being used
as the divisor, producing incorrect ts_rate values and potentially
undefined behaviour.

Fix this by pre-computing ts_freq = hw->psm_clk_freq /
ICE_RL_PROF_TS_MULTIPLIER once before the loop and then dividing only
by pow_result inside the loop. The division order avoids the overflow
while preserving the same mathematical result. Declare ts_freq as s64
to match the type domain of the surrounding arithmetic and avoid a
redundant cast at the use site.

While at it, scope the loop variable i to the for statement itself.

Fixes: 1ddef455f4a8 ("ice: Add NDO callback to set the maximum per-queue bitrate")
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
---
 drivers/net/ethernet/intel/ice/ice_sched.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c
index fff0c1a..edea262c 100644
--- a/drivers/net/ethernet/intel/ice/ice_sched.c
+++ b/drivers/net/ethernet/intel/ice/ice_sched.c
@@ -3237,12 +3237,12 @@ static int
 ice_sched_bw_to_rl_profile(struct ice_hw *hw, u32 bw,
 			   struct ice_aqc_rl_profile_elem *profile)
 {
+	s64 ts_freq = hw->psm_clk_freq / ICE_RL_PROF_TS_MULTIPLIER;
 	s64 bytes_per_sec, ts_rate, mv_tmp;
 	int status = -EINVAL;
 	bool found = false;
 	s32 encode = 0;
 	s64 mv = 0;
-	s32 i;
 
 	/* Bw settings range is from 0.5Mb/sec to 100Gb/sec */
 	if (bw < ICE_SCHED_MIN_BW || bw > ICE_SCHED_MAX_BW)
@@ -3255,8 +3255,7 @@ ice_sched_bw_to_rl_profile(struct ice_hw *hw, u32 bw,
-	for (i = 0; i < 64; i++) {
+	for (int i = 0; i < 64; i++) {
 		u64 pow_result = BIT_ULL(i);
 
-		ts_rate = div64_long((s64)hw->psm_clk_freq,
-				     pow_result * ICE_RL_PROF_TS_MULTIPLIER);
+		ts_rate = div64_long(ts_freq, pow_result);
 		if (ts_rate <= 0)
 			continue;
 
-- 
2.52.0

Re: [PATCH iwl-next] ice: prevent integer overflow

[Simon Horman]

On Fri, Mar 20, 2026 at 06:05:44AM +0100, Aleksandr Loktionov wrote:
> From: Lukasz Czapnik <lukasz.czapnik@intel.com>
> 
> In ice_sched_bw_to_rl_profile(), the loop over 64 bits computes the
> scheduler timestamp rate as:
> 
>   ts_rate = div64_long((s64)hw->psm_clk_freq,
>                        pow_result * ICE_RL_PROF_TS_MULTIPLIER);
> 
> where pow_result = BIT_ULL(i). For large values of i, the product
> pow_result * ICE_RL_PROF_TS_MULTIPLIER overflows u64 before being used
> as the divisor, producing incorrect ts_rate values and potentially
> undefined behaviour.
> 
> Fix this by pre-computing ts_freq = hw->psm_clk_freq /
> ICE_RL_PROF_TS_MULTIPLIER once before the loop and then dividing only
> by pow_result inside the loop. The division order avoids the overflow
> while preserving the same mathematical result. Declare ts_freq as s64
> to match the type domain of the surrounding arithmetic and avoid a
> redundant cast at the use site.
> 
> While at it, scope the loop variable i to the for statement itself.
> 
> Fixes: 1ddef455f4a8 ("ice: Add NDO callback to set the maximum per-queue bitrate")
> Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
> Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

Reviewed-by: Simon Horman <horms@kernel.org>