Re: [PATCH net] net: octeontx2-pf: Fix UB in shift operation

[Ratheesh Kannoth <rkannoth@marvell.com>]

On 2026-07-24 at 17:49:43, Sergey.V.Frolov@kaspersky.com (Sergey.V.Frolov@kaspersky.com) wrote:
> From: "Sergey.V.Frolov" <Sergey.V.Frolov@kaspersky.com>
>
> In function otx2_get_egress_burst_cfg, when the parameter `burst` is
> 255 and the max mantissa is 255 (0xFFULL), `burst_exp` is set to
> `ilog2(255) - 1`, which equals 6.
>
> This results in an unsigned wrap-around when calculating
> `(1ULL << (*burst_exp - 7))`, since `*burst_exp - 7` becomes -1,
> which makes the shift operand 0xFFFFFFFF. This value is greater than
> the width of the left operand.
>
> According to standard 6.5.7 p.3:
> "The type of the result is that of the promoted left operand.
> If the value of the right operand is negative or is greater than
> or equal to the width of the promoted left operand, the behavior
> is undefined."
>
> Add a check to handle cases where `*burst_exp` is less than 7.
>
> Signed-off-by: Sergey.V.Frolov <Sergey.V.Frolov@kaspersky.com>
> ---
>  drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
> index 40162b08014d..39bd73a214af 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
> @@ -53,10 +53,15 @@ static void otx2_get_egress_burst_cfg(struct otx2_nic *nic, u32 burst,
>  	if (burst) {
>  		*burst_exp = ilog2(burst) ? ilog2(burst) - 1 : 0;
>  		tmp = burst - rounddown_pow_of_two(burst);
> -		if (burst < max_mantissa)
> +		if (burst <= max_mantissa) {

Thanks.
can we handle 255 case with <= ? it looks simple to me.