When the DCBX application feature is disabled, bnx2x stores INVALID_TRAFFIC_TYPE_PRIORITY (0xffffffff) in traffic_type_priority[]. bnx2x_dcbx_map_nw() uses that value as a shift count, which UBSAN reports as: shift exponent 4294967295 is too large for 32-bit type 'int' bnx2x_dcbx_fw_struct() assigns the same sentinel to a u8 before shifting, so UBSAN reports exponent 255. Skip priorities outside 0..MAX_PFC_PRIORITIES-1 when building COS bitmasks and when filling the firmware TX-start structure. Keep the stored sentinel so disabled-app state remains visible; skipped firmware entries stay zero from the existing memset. Valid 802.1p priorities 0..7 keep the previous mapping and firmware encoding. A userspace UBSAN extraction of these two functions reproduces the unpatched shifts and passes after this change. This is not a kernel or hardware test; the driver was not rebuilt or loaded. Fixes: 09b775e7ec08 ("bnx2x: dcb - send all unmapped priorities to same COS as L2") Fixes: e4901dde12d9 ("bnx2x: add DCB support") Assisted-by: LLM Signed-off-by: Lâm Trần --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c index 9af8163..e429e64 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c @@ -350,13 +350,20 @@ static void bnx2x_dcbx_map_nw(struct bnx2x *bp) int i; u32 unmapped = (1 << MAX_PFC_PRIORITIES) - 1; /* all ones */ u32 *ttp = bp->dcbx_port_params.app.traffic_type_priority; - u32 nw_prio = 1 << ttp[LLFC_TRAFFIC_TYPE_NW]; + u32 nw_prio; struct bnx2x_dcbx_cos_params *cos_params = bp->dcbx_port_params.ets.cos_params; + if (ttp[LLFC_TRAFFIC_TYPE_NW] >= MAX_PFC_PRIORITIES) + return; + + nw_prio = 1 << ttp[LLFC_TRAFFIC_TYPE_NW]; + /* get unmapped priorities by clearing mapped bits */ - for (i = 0; i < LLFC_DRIVER_TRAFFIC_TYPE_MAX; i++) - unmapped &= ~(1 << ttp[i]); + for (i = 0; i < LLFC_DRIVER_TRAFFIC_TYPE_MAX; i++) { + if (ttp[i] < MAX_PFC_PRIORITIES) + unmapped &= ~(1 << ttp[i]); + } /* find cos for nw prio and extend it with unmapped */ for (i = 0; i < ARRAY_SIZE(bp->dcbx_port_params.ets.cos_params); i++) { @@ -1871,6 +1878,9 @@ static void bnx2x_dcbx_fw_struct(struct bnx2x *bp, /* Fill priority parameters */ for (pri = 0; pri < LLFC_DRIVER_TRAFFIC_TYPE_MAX; pri++) { + if (ttp[pri] >= MAX_PFC_PRIORITIES) + continue; + tt2cos[pri].priority = ttp[pri]; pri_bit = 1 << tt2cos[pri].priority; -- 2.50.1 (Apple Git-155)