[PATCH net] bonding: fix u32 overflow in compute_gap()

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@xxxxxxxxxx>

compute_gap() computes the gap between a slave's link capacity and its
current TLB load. Both terms use u32 left-shifts that overflow on modern
hardware:

  - slave->speed is u32 in Mbps; speed << 20 overflows at > 4Gbps.
  - SLAVE_TLB_INFO(slave).load is u32; load << 3 overflows at > 512M.

Cast both operands to s64 before shifting so the arithmetic is performed
in 64 bits. Also update the comment to make it more clear.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>
---
 drivers/net/bonding/bond_alb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 839f7482dc18..818c18c6ee52 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -160,8 +160,8 @@ static void tlb_deinitialize(struct bonding *bond)
 
 static long long compute_gap(struct slave *slave)
 {
-	return (s64) (slave->speed << 20) - /* Convert to Megabit per sec */
-	       (s64) (SLAVE_TLB_INFO(slave).load << 3); /* Bytes to bits */
+	return ((s64)slave->speed << 20) - /* Mbit/s -> bit/s */
+	       ((s64)SLAVE_TLB_INFO(slave).load << 3); /* Byte/s -> bit/s */
 }
 
 static struct slave *tlb_get_least_loaded_slave(struct bonding *bond)

---
base-commit: 44871eadd07a7f004aa00cb87399461eea08c630
change-id: 20260806-bond_overflow-ac6a6a78d6a0

Best regards,
-- 
Hangbin Liu <liuhangbin@xxxxxxxxxx>