From: Hangbin Liu compute_gap() computes the gap between a slave's link capacity and its current TLB load. Both terms use u32 left-shifts that overflow on modern hardware: - slave->speed is u32 in Mbps; speed << 20 overflows at > 4Gbps. - SLAVE_TLB_INFO(slave).load is u32; load << 3 overflows at > 512M. Cast both operands to s64 before shifting so the arithmetic is performed in 64 bits. Also update the comment to make it more clear. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Hangbin Liu --- drivers/net/bonding/bond_alb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 839f7482dc18..818c18c6ee52 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -160,8 +160,8 @@ static void tlb_deinitialize(struct bonding *bond) static long long compute_gap(struct slave *slave) { - return (s64) (slave->speed << 20) - /* Convert to Megabit per sec */ - (s64) (SLAVE_TLB_INFO(slave).load << 3); /* Bytes to bits */ + return ((s64)slave->speed << 20) - /* Mbit/s -> bit/s */ + ((s64)SLAVE_TLB_INFO(slave).load << 3); /* Byte/s -> bit/s */ } static struct slave *tlb_get_least_loaded_slave(struct bonding *bond) --- base-commit: 44871eadd07a7f004aa00cb87399461eea08c630 change-id: 20260806-bond_overflow-ac6a6a78d6a0 Best regards, -- Hangbin Liu