RxDMAIntCtrl encodes rx_coalesce in the low 16 bits
and rx_timeout in the high 16 bits. If either value exceeds
the field width, the current code may truncate the value and/or
corrupt adjacent bits when programming the register.

Mask both values to 16 bits so only the intended fields are written.

Found by inspection.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Tested-on: D-Link DGE-550T Rev-A3
Signed-off-by: Yeounsu Moon <yyyynoom@gmail.com>
---
Changelog:
v2:
- drop unnecessary cast
v1: https://lore.kernel.org/netdev/20251223001006.17285-1-yyyynoom@gmail.com/
---
 drivers/net/ethernet/dlink/dl2k.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
index 846d58c769ea..74e0fd08d828 100644
--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
@@ -590,7 +590,8 @@ static void rio_hw_init(struct net_device *dev)
 
 	set_multicast (dev);
 	if (np->coalesce) {
-		dw32(RxDMAIntCtrl, np->rx_coalesce | np->rx_timeout << 16);
+		dw32(RxDMAIntCtrl, (np->rx_coalesce & 0x0000ffff) |
+				    (np->rx_timeout & 0x0000ffff) << 16);
 	}
 	/* Set RIO to poll every N*320nsec. */
 	dw8(RxDMAPollPeriod, 0x20);
-- 
2.52.0

On Sat,  3 Jan 2026 18:29:05 +0900 Yeounsu Moon wrote:
> RxDMAIntCtrl encodes rx_coalesce in the low 16 bits
> and rx_timeout in the high 16 bits. If either value exceeds
> the field width, the current code may truncate the value and/or
> corrupt adjacent bits when programming the register.
> 
> Mask both values to 16 bits so only the intended fields are written.

Realistically IDK if this is worth it.

Paolo suggested in discussion on v1 that error checking could introduce
a regression. If we take that concern seriously we can't change the
(buggy) behavior at all.

That said the overflow is on frames, for values > 64k and the ring is
256 so IDK how high values could possibly work here in the first place.

Given this driver is using module params to configure coalescing I'd
just leave this mess be. If you add ethtool configuration for
coalescing make sure to correctly bound-check it.
-- 
pw-bot: reject

On Tue Jan 6, 2026 at 9:58 AM KST, Jakub Kicinski wrote:
> Realistically IDK if this is worth it.
>
> Paolo suggested in discussion on v1 that error checking could introduce
> a regression. If we take that concern seriously we can't change the
> (buggy) behavior at all.
>
> That said the overflow is on frames, for values > 64k and the ring is
> 256 so IDK how high values could possibly work here in the first place.
>
> Given this driver is using module params to configure coalescing I'd
> just leave this mess be. If you add ethtool configuration for
> coalescing make sure to correctly bound-check it.

Thanks for the feedback.

Understood. I'll drop this patch rather changing the current behavior.

If I add ethtool coalesce support for this driver, I'll make sure to
valid and properly bound-check the values before writing the register.

    Yeounsu Moon