Re: [PATCH net v2] net: octeontx2-pf: Fix UB in shift operation

[Ratheesh Kannoth]

On 2026-08-04 at 17:34:48, Sergey.V.Frolov@xxxxxxxxxxxxx (Sergey.V.Frolov@xxxxxxxxxxxxx) wrote:
> From: "Sergey V. Frolov" <Sergey.V.Frolov@xxxxxxxxxxxxx>
>
> In function otx2_get_egress_burst_cfg, when the parameter `burst` is
> 255 and the max mantissa is 255 (0xFFULL), `burst_exp` is set to
> `ilog2(255) - 1`, which equals 6.
>
> This results in an unsigned wrap-around when calculating
> `(1ULL << (*burst_exp - 7))`, since `*burst_exp - 7` becomes -1,
> which makes the shift operand 0xFFFFFFFF. This value is greater than
> the width of the left operand.
>
> According to standard 6.5.7 p.3:
> "The type of the result is that of the promoted left operand.
> If the value of the right operand is negative or is greater than
> or equal to the width of the promoted left operand, the behavior
> is undefined."
>
> Fix the off-by-one boundary condition.
>
> Add a WARN_ON(*burst_exp < 7) before the else branch as an
> explicit safeguard. This ensures that if max_mantissa ever changes
> in a way that reintroduces this condition, it will be immediately
> caught at runtime rather than silently triggering UB.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: e638a83f167e ("octeontx2-pf: TC_MATCHALL egress ratelimiting offload")
> Signed-off-by: Sergey V. Frolov <Sergey.V.Frolov@xxxxxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx

Reviewed-by: Ratheesh Kannoth <rkannoth@xxxxxxxxxxx>