RxDMAIntCtrl encodes rx_coalesce in the low 16 bits and rx_timeout in the high 16 bits. If either value exceeds the field width, the current code may truncate the value and/or corrupt adjacent bits when programming the register. Mask both values to 16 bits and cast to u32 before shifting so only the intended fields are written. Found by inspection. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-on: D-Link DGE-550T Rev-A3 Signed-off-by: Yeounsu Moon --- drivers/net/ethernet/dlink/dl2k.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c index 846d58c769ea..f6ec0e4689f7 100644 --- a/drivers/net/ethernet/dlink/dl2k.c +++ b/drivers/net/ethernet/dlink/dl2k.c @@ -590,7 +590,8 @@ static void rio_hw_init(struct net_device *dev) set_multicast (dev); if (np->coalesce) { - dw32(RxDMAIntCtrl, np->rx_coalesce | np->rx_timeout << 16); + dw32(RxDMAIntCtrl, ((u32)np->rx_coalesce & 0x0000ffff) | + (((u32)np->rx_timeout & 0x0000ffff) << 16)); } /* Set RIO to poll every N*320nsec. */ dw8(RxDMAPollPeriod, 0x20); -- 2.52.0